[Federal Register Volume 70, Number 197 (Thursday, October 13, 2005)]
[Rules and Regulations]
[Pages 59848-59889]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 05-19601]



[[Page 59847]]

-----------------------------------------------------------------------

Part III





Environmental Protection Agency





-----------------------------------------------------------------------



40 CFR Parts 3, 9, 51 et al.



Cross-Media Electronic Reporting; Final Rule

  Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / 
Rules and Regulations  

[[Page 59848]]


-----------------------------------------------------------------------

ENVIRONMENTAL PROTECTION AGENCY

40 CFR Parts 3, 9, 51, 60, 63, 69, 70, 71, 123, 142, 145, 162, 233, 
257, 258, 271, 281, 403, 501, 745 and 763

[FRL-7977-1]
RIN 2025-AA07


Cross-Media Electronic Reporting

AGENCY: Environmental Protection Agency (EPA).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: EPA is establishing the framework by which it will accept 
electronic reports from regulated entities in satisfaction of certain 
document submission requirements in EPA's regulations. EPA will provide 
public notice when the Agency is ready to receive direct submissions of 
certain documents from regulated entities in electronic form consistent 
with this rulemaking via an EPA electronic document receiving system. 
This rule does not mandate that regulated entities utilize electronic 
methods to submit documents in lieu of paper-based submissions. In 
addition, EPA is not taking final action on the electronic 
recordkeeping requirements at this time.
    States, tribes, and local governments will be able to seek EPA 
approval to accept electronic documents to satisfy reporting 
requirements under environmental programs that EPA has delegated, 
authorized, or approved them to administer. This rule includes 
performance standards against which a state's, tribe's, or local 
government's electronic document receiving system will be evaluated 
before EPA will approve changes to the delegated, authorized, or 
approved program to provide electronic reporting, and establishes a 
streamlined process that states, tribes, and local governments can use 
to seek and obtain such approvals.

DATES: This rule shall become effective January 11, 2006.

ADDRESSES: The public record for this rulemaking has been established 
under docket number OEI-2003-0001 and is located in the EPA Docket 
Center, (EPA/DC) EPA West, Room B102, 1301 Constitution Ave., NW., 
Washington, DC. The EPA Docket Center Public Reading Room is open from 
8:30 a.m. to 4:30 p.m., Monday through Friday, excluding legal 
holidays. (See SUPPLEMENTARY INFORMATION below.)

FOR FURTHER INFORMATION CONTACT: For general information on this final 
rule, contact the docket above. For more detailed information on 
specific aspects of this rulemaking, contact David Schwarz (2823T), 
Office of Environmental Information, U.S. Environmental Protection 
Agency, 1200 Pennsylvania Avenue, NW., Washington, DC 20460, (202) 566-
1704, [email protected], or Evi Huffer (2823T), Office of 
Environmental Information, U.S. Environmental Protection Agency, 1200 
Pennsylvania Avenue, NW., Washington, DC 20460, (202) 566-1697, 
[email protected].

SUPPLEMENTARY INFORMATION:

General Information

A. Affected Entities

    This rule will potentially affect states, tribes, and local 
governments that have been delegated, authorized, or approved, or which 
seek delegation, authorization, or approval to administer a federal 
environmental program under Title 40 of the Code of Federal Regulations 
(CFR). For purposes of this rulemaking, the term ``state'' includes the 
District of Columbia and the United States territories, as specified in 
the applicable statutes. That is, the term ``state'' includes the 
District of Columbia, the Commonwealth of Puerto Rico, the Virgin 
Islands, Guam, American Samoa, the Commonwealth of Northern Marina 
Islands, and the Trust Territory of the Pacific Islands, depending on 
the statute.
    The rule will also potentially affect private parties subject to 
any requirements in Title 40 of the CFR that require a document to be 
submitted to EPA. Affected Entities include, but are not necessarily 
limited to:

------------------------------------------------------------------------
                                                Examples of affected
                 Category                             entities
------------------------------------------------------------------------
Local government..........................  Publicly owned treatment
                                             works, owners and operators
                                             of treatment works treating
                                             domestic sewage, local and
                                             regional air boards, local
                                             and regional waste
                                             management authorities, and
                                             municipal and other
                                             drinking water authorities.
Private...................................  Industry owners and
                                             operators, waste
                                             transporters, privately
                                             owned treatment works or
                                             other treatment works
                                             treating domestic sewage,
                                             privately owned water
                                             works, small businesses of
                                             various kinds, sponsors
                                             such as laboratories that
                                             submit or initiate/support
                                             studies, and testing
                                             facilities that both
                                             initiate and conducts
                                             studies.
Tribe and State governments...............  States, tribes or
                                             territories that administer
                                             any federal environmental
                                             programs delegated,
                                             authorized, or approved by
                                             EPA under Title 40 of the
                                             CFR.
Federal government........................  Federally owned treatment
                                             works and industrial
                                             dischargers, and federal
                                             facilities subject to
                                             hazardous waste regulation.
------------------------------------------------------------------------

    This table is not intended to be exhaustive, but rather provides a 
guide for readers regarding entities likely to be affected by this 
action. This table lists the types of entities that EPA is now aware 
can potentially be affected by this action. Other types of entities not 
listed in the table can also be affected. If you have questions 
regarding the applicability of this action to a particular entity, 
consult the person listed in the preceding FOR FURTHER INFORMATION 
CONTACT section.

B. How Can I Get Copies of This Document and Other Related Information?

    1. Docket. EPA has established an official public docket for this 
action under Docket ID No. OEI-2003-0001. The official public docket 
consists of the documents specifically referenced in this action, any 
public comments received, and other information related to this action. 
Although a part of the official docket, the public docket does not 
include Confidential Business Information (CBI) or other information 
whose disclosure is restricted by statute. The official public docket 
is the collection of materials that is available for public viewing at 
the Cross-Media Electronic Reporting Rule (CROMERR) Docket in the EPA 
Docket Center (EPA/DC), EPA West, Room B102, 1301 Constitution Ave., 
NW., Washington, DC. The EPA Docket Center Public Reading Room is open 
from 8:30 a.m. to 4:30 p.m., Monday through Friday, excluding legal 
holidays. The telephone number for the Public Reading Room is (202) 
566-1744, and the telephone number for the Office of Environmental 
Information Docket is (202) 566-1752. You may have to pay a reasonable 
fee for copying.
    An electronic version of the public docket is available through 
EPA's

[[Page 59849]]

electronic public docket and comment system, EDOCKET. You may use 
EDOCKET at http://www.epa.gov/edocket/ to view public comments, access 
the index listing of the contents of the official public docket, and to 
access those documents in the public docket that are available 
electronically. Although not all docket materials may be available 
electronically, you may still access any of the publicly available 
docket materials. After selecting the ``Using EDOCKET'' icon, select 
``quick search,'' then key in the appropriate docket identification 
number. Double click on the document identification number to bring up 
the docket contents.
    2. Electronic Access. You may access this Federal Register document 
electronically through the EPA Internet under the ``Federal Register'' 
listings at http://www.epa.gov/fedrgstr/.

Organization of This Document

    Information in this Preamble is organized as follows:
I. Overview
    A. Why does the Agency seek to provide electronic alternatives 
to paper-based reporting and recordkeeping?
    B. What does the electronic reporting rule do?
    C. What is the status of the proposed electronic recordkeeping 
provisions?
    D. How were stakeholders consulted during the development of 
today's final rule?
    E. What alternatives to today's final rule did EPA consider?
II. Background
    A. What has been EPA's electronic reporting policy?
    B. How does today's final rule change EPA's electronic reporting 
policy?
III. Scope of the Electronic Reporting Rule
    A. Who may submit electronic documents?
    B. Which documents can be filed electronically?
    C. How does this final rule implement electronic reporting?
IV. Major Changes from Proposed Electronic Reporting Provisions
    A. How does the rule streamline the approval of electronic 
reporting under authorized state, tribe, and local government 
programs?
    1. Review of the proposal
    2. Comments on the proposal
    3. Revisions in the final rule
    B. How has EPA revised the requirements that state, tribe, and 
local government electronic reporting programs must satisfy?
    1. Review of the proposal
    2. Comments on the proposed criteria for electronic document 
receiving systems
    3. Revisions to the criteria in the final rule
    C. How has EPA accommodated electronic submissions with follow-
on paper certifications?
    D. How has EPA changed proposed definitions of terms?
    1. Definition of ``acknowledgment''
    2. Definition of ``electronic document''
    3. Definition of ``electronic signature''
    4. Definition of ``electronic signature device''
    5. Definition of ``transmit''
    6. Definition of ``valid electronic signature''
V. Requirements for Direct Electronic Reporting to EPA
    A. What are the requirements for electronic reporting to EPA?
    B. What is the status of existing electronic reporting to EPA?
    C. What is EPA's Central Data Exchange?
    1. Overview of general goals
    2. Comments on the proposal
    3. The aspects of CDX that have not changed since proposal
    4. The major changes that EPA has made to CDX since proposal
    D. How will EPA provide notice of changes to CDX?
VI. Requirements for Electronic Reporting under EPA-Authorized 
Programs
    A. What is the general regulatory approach?
    B. When must authorized state, tribe, or local government 
programs revise or modify their programs to allow electronic 
reporting?
    1. The general requirement
    2. Deferred compliance for existing systems
    C. What alternative procedures does EPA provide for revising or 
modifying authorized state, tribe, or local government programs for 
electronic reporting?
    1. The application
    2. Review for completeness
    3. EPA actions on applications
    4. Revisions or modifications associated with existing systems
    5. Public hearings for Part 142 revisions or modifications
    6. Re-submissions and amendments
    D. What general requirements must state, tribe, and local 
government electronic reporting programs satisfy?
    E. What standards must state, tribe, and local government 
electronic document receiving systems satisfy?
    1. Timeliness of data generation
    2. Copy of record
    3. Integrity of the electronic document
    4. Submission knowingly
    5. Opportunity to review and repudiate copy of record
    6. Validity of the electronic signature
    7. Binding the signature to the document
    8. Opportunity to review
    9. Understanding the act of signing
    10. The electronic signature or subscriber agreement
    11. Acknowledgment of receipt
    12. Determining the identity of the individual uniquely entitled 
to use a signature device
VII. What are the Costs of Today's Rule?
    A. Summary of proposal analysis
    B. Final rule costs
    C. General changes to methodology and assumptions
VIII. Statutory and Executive Order Reviews
    A. Executive Order 12866
    B. Executive Order 13132
    C. Paperwork Reduction Act
    D. Regulatory Flexibility Act
    E. Unfunded Mandates Reform Act
    F. National Technology Transfer and Advancement Act
    G. Executive Order 13045
    H. Executive Order 13175
    I. Executive Order 13211 (Energy Effects)
    J. Congressional Review Act

I. Overview

A. Why does the Agency seek to provide electronic alternatives to 
paper-based reporting and recordkeeping?

    In the Federal Register of August 31, 2001 (66 FR 46162), EPA 
published a notice of proposed rulemaking, announcing the goal of 
making electronic reporting and electronic recordkeeping available 
under EPA regulatory programs. The Agency believes that the submission 
and storage of electronic documents in lieu of paper documents can:
     Reduce the cost and burden of data transfer and 
maintenance for all parties to the data exchanges;
     Improve the data and the various business processes 
associated with its use in ways that may not be reflected directly in 
cost-reduction, e.g., through improvements in data quality, and the 
speed and convenience with which data may be transferred and used; and
     Maintain the level of corporate and individual 
responsibility and accountability for electronic reports and records 
that currently exists in the paper environment.

Recent federal policy and law are also strong drivers of electronic 
alternatives to traditional reporting and recordkeeping. The Government 
Paperwork Elimination Act (GPEA) of 1998, Title XVII of Public Law 105-
277, requires the Director of the Office of Management and Budget (OMB) 
to ensure that executive agencies provide for the option of the 
electronic maintenance, submission, or disclosure of information as a 
substitute for paper when practicable, and for the use and acceptance 
of electronic signatures, when practicable. See GPEA section 1704. 
Given the enormous strides in data transfer and management 
technologies, particularly in connection with the Internet, replacing 
paper with electronic data transfer now promises increased productivity 
across almost all facets of business and government.
    In seeking to make electronic alternatives available that were not 
contemplated when most existing EPA regulations were written, EPA was 
mindful of the need to maintain our ability to carry out our statutory 
environmental and health protection mission, in part through ensuring 
the integrity of environmental compliance documents. Accordingly, the 
intended

[[Page 59850]]

effect of the proposed regulation was to permit and encourage the use 
of electronic technologies in a manner that is consistent with EPA's 
overall mission and that preserves the integrity of the Agency's 
compliance and enforcement activities.
    The Agency believes that it is essential to ensure that electronic 
reports can play the same role as their paper counterparts in providing 
evidence of what was reported and to what identified individuals 
certified with respect to the report. Otherwise, electronic reporting 
places at risk the continuing viability of self-monitoring and self-
reporting that provides the framework for compliance under most of our 
environmental programs. The purpose of today's final rule is therefore 
twofold. Today's rule is intended to provide regulated industry, EPA, 
and state, tribe, and local governments with electronic reporting 
alternatives that improve the efficiency, the speed, and the quality of 
regulatory reporting. At the same time, the rule is intended to ensure 
the legal dependability of electronic documents submitted under 
environmental programs. This includes, among other things, ensuring 
that individuals will be held as responsible and accountable for the 
electronic signatures, which they execute, and for the documents to 
which such signatures attest as they currently are in cases of 
documents where they execute handwritten signatures.

B. What does the electronic reporting rule do?

    EPA is announcing today the final regulatory provisions in a new 
part 3 of Title 40 of the CFR for electronic reporting to EPA and under 
authorized state, tribe, and local government programs. ``Authorized 
program'' is shorthand for a federal program that EPA has delegated, 
authorized, or approved a state, tribe or local government to 
administer under other provisions of title 40 of the CFR, where the 
delegation, authorization, or approval has not been withdrawn or 
expired. Section 3.3 of the rule codifies this usage in the regulatory 
text. This use of ``authorized'' does not mean that EPA is precluded 
from an enforcement action by a prior enforcement action being taken by 
a state, tribe, or local government under its authorized program. The 
final rule incorporates changes made after publication of the proposed 
rule that are discussed in detail in section IV of this Preamble. This 
rule establishes electronic reporting as an acceptable regulatory 
alternative across a broad spectrum of EPA programs, and establishes 
requirements to assure that electronic documents are as legally 
dependable as their paper counterparts.
    The requirements in Subpart B of the rule apply to entities that 
choose to submit electronic documents for direct reporting to EPA, 
including state, tribe, and local government facilities that choose to 
submit electronic documents to EPA to satisfy requirements that apply 
to them under other provisions of title 40 of the CFR. However, the 
scope of this final rule excludes any data transfers between EPA and 
states, tribes, or local governments as a part of their authorized 
programs or as a part of administrative arrangements between states, 
tribes, or local governments and EPA to share data. The requirements in 
Subpart D of the rule provide for electronic reporting under authorized 
state, tribe, and local government programs and apply to the 
governmental entities administering the authorized programs. Under the 
final rule, states, tribes, and local governments have the choice of 
using electronic submission rather than paper for reporting under their 
authorized programs. Comments on the proposed rule indicated that some 
states and local governments are now requiring electronic reporting 
under those programs. Existing electronic document receiving systems 
must receive EPA approval in accordance with Subpart D in order to meet 
the requirements of part 3.
    This rule does not require that any document be submitted 
electronically, and it does not require any state, tribe, or local 
authorized program to receive electronic documents. Public access to 
environmental compliance information is not affected by today's action.
    Additionally, the scope of the final rule specifically excludes the 
submission of any electronic document via magnetic or optical media--
for example via diskette, compact disk (CD), digital video disc (DVD), 
or tape--as well as the transmission of documents via hard copy 
facsimile or ``fax.'' The exclusion of magnetic or optical media 
submissions from the scope of this rule in no way indicates EPA's 
rejection of these technologies as a valid approach to paperless 
reporting. Magnetic and optical media submissions fulfill the goal of 
providing alternatives to submission on paper. EPA has already 
successfully implemented a paperless reporting alternative that 
utilizes magnetic and optical media submissions to fulfill many 
regulatory reporting requirements. Such instances include reporting 
related to the hazardous waste, Toxic Release Inventory, and pesticide 
registration programs. EPA expects these magnetic and optical media 
approaches to paperless reporting to continue, and nothing in today's 
rule should be interpreted to proscribe or discourage them.
    For entities that report to EPA directly and do so by submitting 
electronic documents, today's action requires that these documents be 
submitted either to the Agency's centralized electronic document 
receiving system, called the ``Central Data Exchange'' (CDX), or to 
alternative systems designated by the Administrator as described herein 
and in a separate Federal Register notice. Entities that submit 
electronic documents directly to EPA will satisfy the requirements in 
today's rule by successfully submitting their reports to one of these 
systems. While we do not intend to codify any of the details of how CDX 
operates or how it is constructed, the characteristics of the CDX and 
the submission scenarios are described later in this Preamble. In 
addition, the CDX design specifications are included as a part of this 
rulemaking docket.
    Many facilities submit documents directly to states, tribes, or 
local governments under authorized programs. For currently authorized 
programs that receive or wish to begin receiving electronic documents 
in lieu of paper, this rule requires EPA approval of program revisions 
or modifications that address their electronic reporting 
implementations. For programs initially seeking authorization, this 
rule requires EPA approval of any electronic reporting components of 
the programs. In both cases, EPA approval will be based largely on an 
assessment of the program's ``electronic document receiving system'' 
that is or will be used to implement electronic reporting. For this 
purpose, this rule includes performance-based standards that EPA will 
use to determine that an electronic document receiving system is 
acceptable. To implement electronic reporting under currently 
authorized programs, EPA is creating a streamlined procedure that 
states, tribes, and local governments may use to revise or modify their 
authorized programs to incorporate electronic reporting. Today's 
rulemaking also includes special provisions for authorized programs' 
electronic document receiving systems that exist at the time of 
publication of this final rule.
    It is worth noting that EPA can approve changes to authorized 
state, tribe, or local programs that involve the use of CDX to receive 
data submissions from their reporting communities, and EPA is exploring 
opportunities to

[[Page 59851]]

leverage CDX resources for use by states, tribes, and local 
governments. As currently implemented, CDX provides the major systems 
infrastructure components necessary to achieve electronic reporting 
consistent with the standards in this rule for assessing state, tribe, 
or local government electronic document receiving systems. 
Additionally, EPA has set the goal of making CDX operations fully 
consistent with the requirements in today's rule within two years.
    While today's rule establishes electronic reporting as a regulatory 
alternative, EPA will make the electronic submission alternative 
available for specific reports or other documents only as EPA announces 
its readiness to receive them through CDX or another designated system. 
EPA will publish announcements in the Federal Register as CDX and other 
systems become available for particular environmental reports. These 
elements are discussed in more detail in section V of this Preamble.
    In a notice published concurrently with today's rule, EPA clarifies 
the status of electronic reporting directly to EPA systems that exist 
as of the rule's publication date. In accordance with 40 CFR 3.10, EPA 
is designating for the receipt of electronic submissions, all EPA 
electronic document receiving systems currently existing and receiving 
electronic reports as of the date of the notice. This designation is 
valid for a period of up to two years from the date of publication of 
the notice. During this two-year period, entities that report directly 
to EPA may continue to satisfy EPA reporting requirements by reporting 
to the same systems as they did prior to CROMERR's publication unless 
EPA publishes a notice that announces changes to, or migration from, 
that system. Any existing system continuing to receive electronic 
reports at the expiration of this two-year period must receive 
redesignation by the Administrator under Sec.  3.10. Notice of such 
redesignation will be published in the Federal Register.

C. What is the status of the proposed electronic recordkeeping 
provisions?

    At this time, EPA is only finalizing the provisions for electronic 
reporting to EPA and under authorized programs. The August 31, 2001, 
proposal, however, also addressed records that EPA or authorized 
programs require entities to maintain under any of the environmental 
programs governed by Title 40 of the CFR or related state, tribe, and 
local laws and regulations. For such records, EPA proposed specific 
provisions for administering the maintenance of electronic records 
under these environmental regulations. EPA proposed criteria under 
which the Agency would consider electronic records to be trustworthy, 
reliable, and generally equivalent to paper records in satisfying 
regulatory requirements. For entities that choose to keep records 
electronically, the proposal would have required the adoption of best 
practices for electronic records management. For facilities maintaining 
records to satisfy the requirements of authorized programs, the 
proposal would have allowed for EPA approval of changes to the 
authorized programs to provide for electronic recordkeeping. Under the 
proposal, approval would have been based on a determination that the 
authorized program would require best practices for electronic records 
management, corresponding to EPA's provisions for electronic records 
maintained to satisfy EPA recordkeeping requirements.
    Further, EPA proposed that once the rule took effect, any records 
subject to the rule that were maintained to satisfy the requirements of 
EPA programs could only be maintained electronically after EPA 
announced in the Federal Register that EPA was ready to allow 
electronic records maintenance to satisfy the specified recordkeeping 
requirements. Also under the proposal, records maintained under an 
authorized state, tribe, or local government program could only be 
maintained electronically once EPA had approved the necessary changes 
to the authorized program.
    Based on the comments received on the proposed electronic 
recordkeeping provisions, EPA reconsidered its approach to electronic 
recordkeeping and is not issuing final recordkeeping rules at this 
time. The Agency is conducting additional analysis and intends to 
publish a supplemental notice or re-proposal to solicit additional 
comments before a final rule on electronic recordkeeping is issued. We 
will be reviewing provisions related to the methods used to ensure 
accuracy, accessibility and the ability to detect alterations of 
records stored electronically, as well as other possible controls for 
electronic recordkeeping. The Agency intends to utilize this review to 
engage states, tribes, local governments, and industry in meaningful 
consultation to ensure that the EPA has the best available information 
on which to base its decisions. In conjunction with these 
consultations--and before issuing any notice or re-proposal--EPA will 
conduct additional analysis on the costs and benefits of alternative 
approaches, and the technical feasibility of various options, with a 
focus on impacts to small businesses. Today's rule does not authorize 
the conversion of existing paper documents retained to comply with 
existing recordkeeping requirements under other provisions of Title 40 
of the CFR to an electronic format for record-retention purposes.

D. How were stakeholders consulted during the development of today's 
final rule?

    This final rule reflects more than ten years of interaction with 
stakeholders that included states, tribes, and local governments, 
industry groups, environmental non-government organizations, national 
standard setting committees, and other federal agencies. As detailed in 
the proposal, many of our most significant interactions involved 
electronic reporting pilot projects conducted with state agency 
partners, including the States of Pennsylvania, New York, Arizona, and 
several others. In May, 1997, work began with approximately 35 states 
on the State Electronic Commerce/Electronic Data Interchange Steering 
Committee (SEES) convened by the National Governors' Association (NGA) 
Center for Best Practices (CBP). Also, EPA sponsored a series of 
conferences and meetings, beginning in June, 1999, with the explicit 
purpose of seeking stakeholder advice before drafting the proposal. 
Reports of these conferences and meetings are available in the docket 
for this rulemaking, along with the product of the SEES effort, a 
document entitled, ``A State Guide for Electronic Reporting of 
Environmental Data,'' and reports on some of the more recent state/EPA 
electronic reporting pilots.
    For the proposal, EPA provided a 6-month public comment period, 
which closed on February 27, 2002. During that time, we received 184 
sets of written comments on the proposed rule. The commenters 
represented a broad spectrum of interested parties: States, local 
governments, specific businesses, trade associations, and other federal 
agencies. Substantive changes to the electronic reporting provisions 
based on public comments are discussed in detail in section IV of this 
Preamble. In addition, EPA received comments at four public meetings 
held around the country and at two meetings with states held in 
Washington, DC. The comments and meeting summaries can be found in the 
docket to this rulemaking. Today's final rule reflects many of the 
comments and concerns raised by commenters on the proposal. (A complete 
discussion of the options considered by EPA and other background 
information on the Agency's policy on electronic reporting

[[Page 59852]]

can be found in the proposed rule.) The majority of comments focused on 
the costs and burden of the proposed Subpart D electronic recordkeeping 
provisions. EPA's response to public comments to the proposal can be 
found in the rulemaking docket, in the Response to Comments document.

E. What alternatives to today's final rule did EPA consider?

    EPA considered both a more stringent and a less stringent 
alternative to the regulatory approach taken in this rule. The more 
stringent alternative is reflected in the electronic provisions 
published, August 31, 2001, in the Notice of Proposed Rulemaking for 
CROMERR. The proposed version of CROMERR was more stringent by virtue 
of setting much more prescriptive, detailed requirements that 
electronic document receiving systems would have to satisfy. For 
example:
     Proposed Sec.  3.2000(d) contained very specific 
requirements for submitter identity management that a system would have 
to satisfy, including detailed requirements for renewal of registration 
and revocation of registration under specified circumstances;
     Proposed Sec.  3.2000(e) contained very detailed 
requirements for the signature/certification scenario that a system 
would have to provide for, specifying the exact sequence of steps to be 
followed in electronically signing a submission, and requiring such 
features as on-screen, scroll-through presentation of the data to be 
submitted for review of the signatory prior to signing.
    EPA received significant public comment on this approach, both from 
states and from regulated companies, and there were at least three 
closely related themes. The first was that such prescriptive 
requirements would greatly limit the flexibility of states to implement 
electronic reporting in a cost-effective way. The second theme was that 
many of the requirements--especially those specifying the signature/
certification scenario--were not appropriate to many cases where 
electronic reporting would occur. Third and finally, many of these 
commenters expressed skepticism that these very detailed requirements 
represented the only possible approach to ensuring the legal 
dependability of electronic submissions and signatures. These themes 
are discussed in detail in section IV.B of this Preamble.
    EPA also considered a less stringent alternative that would have 
refrained from specifying requirements to establish the identity of an 
individual to whom a signature device or credential (e.g. a PIN, 
password, or PKI certificate) is issued. This less stringent 
alternative would have omitted the provision for identity-proofing in 
the final Sec.  3.2000(b)(5)(vii). In terms of regulatory impact, this 
would be a significant reduction in stringency. Most of the burden on 
regulated entities imposed by today's rule is associated with the 
registration process involved in obtaining a signature device or 
credential, and any requirement to establish the registrant's identity 
raises the aggregate burden substantially.
    EPA rejected this less stringent alternative, because we believe 
that it would seriously undermine the rule's ability to assure the 
legal dependability of electronic submissions. It is a basic principle 
of electronic authentication (E-authentication) that individuals being 
authenticated are who they say they are. E-authentication depends 
critically on the degree of trust we can place in the credential the 
individual presents, and such trust depends heavily on the process of 
establishing the individual's identity (or ``identity-proofing'') when 
he or she first registers for the credential. If the identity-proofing 
process is not sufficiently stringent and credible, then it may be 
uncertain who is using the credential in a specific instance where it 
is presented. Where the credential is used to create an electronic 
signature, inadequate identity-proofing may create uncertainty as to 
who the signatory is, as a result, the signature may be rendered 
undependable for any legal purpose. Accordingly, EPA believes that, 
notwithstanding the cost, it is necessary to specify that identity-
proofing be conducted. The Sec.  3.2000(b)(5)(vii) identity-proofing 
requirement is explained in detail in section VI.E.12 of this Preamble.

II. Background

A. What has been EPA's electronic reporting policy?

    On September 4, 1996, EPA published a document entitled ``Notice of 
Agency's General Policy for Accepting Filing of Environmental Reports 
via Electronic Data Interchange (EDI)'' (61 FR 46684) (hereinafter 
referred to as `the 1996 Policy'), where ``EDI'' generally refers to 
the transmission, in a standard syntax, of unambiguous information 
between computers of organizations that may be completely external to 
each other. This notice announced EPA's basic policy for accepting 
electronically submitted environmental reports, and its scope was 
intended to include any regulatory, compliance, or informational 
(voluntary) reporting to EPA via EDI.
    For purposes of the 1996 policy, the standard transmission formats 
used by EPA were to be based on the EDI standards developed and 
maintained by the American National Standards Institute (ANSI) 
Accredited Standards Committee (ASC) X12. By linking our approach to 
the ANSI X12 standards, we hoped to take advantage of the robust ANSI-
based EDI infrastructure already in place for commercial transactions, 
including a wide array of commercial off-the-shelf (COTS) software 
packages and communications network services, and a growing industry 
community of EDI experts available both to EPA and to the regulated 
community. At the time EPA was writing this policy, ANSI-based EDI was 
arguably the dominant mode of electronic commerce across almost all 
business sectors, from aerospace to wood products, at least in the 
United States. (A complete discussion of EPA's 1996 policy can be found 
in the preamble to the proposed rule.)
    With this final rule, EPA is making changes to the 1996 policy for 
three primary reasons. First, and most important, the technology 
environment has changed substantially since the 1996 policy was 
written. Web-based electronic commerce and public key infrastructure 
(PKI) are two examples. While both were available and in use for some 
purposes in 1996, they had not yet achieved the level of acceptance and 
use that they enjoy today. We could not have anticipated in 1996 that 
this evolution would occur as rapidly as it has. Clearly, these 
developments require that we extend our approach to electronic 
reporting beyond EDI and Personal Identification Numbers (PINs). In 
addition, they teach us that it is generally unwise to base regulatory 
requirements on the existing information technology environment or on 
assumptions about the speed and direction of technological evolution.
    Second, we believe that technology-specific provisions would be 
very complex and unwieldy. The resulting regulation would likely place 
unacceptable burdens on regulated entities trying to understand and 
comply.
    Third, and finally, an electronic reporting architecture that makes 
a centralized EPA or state system the platform for such functions as 
electronic signature/certification is now quite viable--and quite 
consistent with the standard practices of Web-based electronic 
commerce. Given the state of technology six years ago, we could not

[[Page 59853]]

have considered this approach in the 1996 policy.

B. How does today's final rule change EPA's electronic reporting 
policy?

    For practical purposes, the most important change that today's rule 
makes is in our technical approach to electronic reporting. In contrast 
to the 1996 policy, today's rule does not generally specify or limit 
the range of allowable electronic submission technologies and formats. 
Under today's rule, complaint electronic reporting approaches can 
include user-friendly `smart' electronic forms to be completed on-line 
or downloaded for completion off-line at the user's personal computer, 
as well as data transfers via the Internet or secure email in a variety 
of standard and common off-the-shelf, application-based formats. 
Similarly, in terms of electronic signature technology, the rule allows 
for a range of approaches, including various implementations of PINs 
and passwords, the use of private or personal information, digital 
signatures based on PKI certificates, and other signature technologies 
as they become viable for our applications. As EPA or authorized 
programs implement electronic submission for specific reports, the rule 
allows them to select one or more of the available submission and 
signature approaches according to their circumstances and the program-
specific requirements.
    EPA's goals are to make this electronic reporting alternative as 
simple, attractive and cost-effective as possible for reporting 
entities, while ensuring that electronically submitted documents are as 
legally dependable as their paper counterparts. We believe that today's 
rule achieves these goals, but--unlike the 1996 policy--without 
requiring specific technologies or setting detailed procedural steps 
for the submission of electronic documents. Our strategy--as initially 
set out in the August 31, 2001, notice of proposed rulemaking, and as 
finalized today--is to impose as few specific requirements as possible 
on reporting entities, and to generally keep requirements neutral with 
respect to technology. As a consequence, today's rule enables EPA, the 
states, tribes, and local governments to offer regulated companies 
diverse approaches to electronic reporting that can be tailored to 
their technical capabilities and to the level of automation they wish 
to achieve. In addition, the strategy gives EPA, the states, tribes, 
and local governments the flexibility to adapt electronic reporting 
systems to evolving technologies without requiring that regulations be 
amended with each technological innovation.
    However, this regulatory strategy does not mean abandoning any 
control over how electronic documents are submitted. In place of 
specific technologies or detailed procedural steps, today's rule 
requires that electronic submissions be made to CDX or other designated 
EPA systems, or to state, tribe, or local government systems that are 
determined to satisfy a certain specified set of technology-neutral 
performance standards. As a practical matter, the use of these systems 
(e.g., CDX or others that meet the specified performance standards) 
will involve submission procedures that we believe are sufficient to 
ensure the legal dependability of electronic reports so that they meet 
the needs of our compliance and enforcement programs. In addition, 
while the specified performance standards may be technology-neutral, 
agency electronic reporting systems that implement the standards will 
incorporate suites of very specific technologies that will further 
determine the process for actual electronic submission. Sections V.B 
and V.C of this Preamble describe these requirements and the associated 
technologies in some detail for the case of reporting directly to EPA 
via CDX.

III. Scope of the Electronic Reporting Rule

    EPA is today promulgating a new Part 3 in Title 40 of the CFR. The 
new Part applies to all persons who submit reports or other documents 
to EPA under Title 40, and to state, tribe, and local programs that 
administer or seek to administer authorized programs under Title 40. 
The new part 3 does not address contracts, grants or financial 
management regulations contained in Title 48 of the CFR.

A. Who may submit electronic documents?

    Any entity that submits documents addressed in this rule (see 
section III.B., below) directly to EPA can submit them electronically 
as soon as EPA announces that CDX or a designated alternative system is 
ready to receive these reports. (See section V of this Preamble for a 
discussion on requirements for electronic reporting to EPA, and section 
V.B for a discussion of the status of electronic reporting directly to 
EPA systems that exist as of the rule's publication date.) Under this 
rule, the affected entities may elect to utilize the electronic 
reporting alternative. These entities are not required by this final 
rule to report electronically; however, they may be required to report 
electronically under other Title 40 regulations, and nothing in today's 
rule limits EPA's ability to require electronic reporting under other 
parts of Title 40.
    In general, entities may submit documents electronically as 
provided for under authorized state, tribe, or local government 
programs. Nothing in this rule prohibits state, tribe, or local 
governments from requiring electronic reporting under applicable state, 
tribe, or local law.

B. Which documents can be filed electronically?

    This rule addresses document submissions required by or permitted 
under any EPA or authorized state, tribe, or local program governed by 
EPA's regulations in Title 40 of the CFR. Nonetheless, EPA will need 
time to develop the hardware and software components required for each 
individual type of document. Similarly, states, tribes, and local 
governments will need time to evaluate their electronic document 
receiving systems to ensure that they meet the standards promulgated in 
today's final rule. Accordingly, once this rule takes effect, specific 
documents submitted directly to EPA that are not already being 
submitted electronically to existing EPA systems can only be submitted 
electronically after EPA announces in the Federal Register that CDX or 
an alternative system is ready to receive those specific documents. 
(See section V.B of this Preamble for a discussion of the status of 
electronic reporting directly to EPA systems that exist as of the 
rule's publication date.) Documents may be submitted electronically 
under the provisions of an authorized state, tribe, or local program.

C. How does this final rule implement electronic reporting?

    The new 40 CFR part 3 consists of four (4) Subparts. Subpart A 
provides that any requirement in Title 40 to submit a report directly 
to EPA can be satisfied with an electronic submission that meets 
certain conditions (specified in Subpart B) once the Agency publishes a 
notice that electronic document submission is available for that 
requirement. Subpart A also provides that electronic reporting can be 
made available under EPA-authorized state, tribe, or local 
environmental programs. In addition, Subpart A makes clear: (1) that 
electronic document submission, while permissible under the terms of 
this rule, is not required by any provision of this rule; and (2) that 
this rule confers no right or privilege to submit data electronically 
and does not obligate EPA or states, tribes, or local

[[Page 59854]]

agencies to accept electronic data. Subpart A also contains key 
definitions and discusses compliance and enforcement.
    Subpart B sets forth the general requirements for acceptable 
electronic documents submitted to EPA. It provides that electronic 
documents must be submitted either to CDX or to other EPA designated 
systems. It also includes general requirements for electronic 
signatures. The requirements in Subpart B apply to entities that submit 
electronic documents for direct reporting to EPA, including states, 
tribes, and local governments that submit electronic documents to EPA 
to satisfy requirements that apply to them under Title 40 of the CFR. 
Subpart B does not apply to any data transfers between EPA and states, 
tribes, or local governments as a part of their authorized programs or 
as a part of administrative arrangements between states, tribes, or 
local governments and EPA to share data. Additionally, Subpart B does 
not apply to the submission of any electronic document via magnetic or 
optical media--for example via diskette, compact disk, or tape--or to 
the transmission of documents via hard copy facsimile or ``fax.''
    Subpart C is reserved for future EPA electronic recordkeeping 
requirements.
    Finally, Subpart D sets forth the process and standards for EPA 
approval of changes to authorized state, tribe, and local environmental 
programs to allow electronic reporting to satisfy requirements under 
these programs. Again, for purposes of Subpart D, ``electronic 
reporting'' entails submission via telecommunications, and Subpart D 
requirements do not apply in cases of submission via magnetic or 
optical media or hard copy ``fax.'' With respect to electronic 
reporting, Subpart D includes simplified performance-based standards 
for acceptable state, tribe, or local agency electronic document 
receiving systems against which EPA will assess authorized program 
electronic reporting elements. It also provides a streamlined process 
for approving applications for revisions to authorized programs for 
electronic reporting.
    Given the provisions of Subpart A, a regulated entity wishing to 
determine whether electronic reporting directly to EPA was available 
under some specific regulation will have to verify that EPA has 
published a Federal Register notice announcing their availability and 
will have to locate any additional provisions or instructions governing 
the electronic alternative for the particular reporting requirement. To 
facilitate this determination, EPA intends to maintain an easily 
accessed list of EPA reports for which electronic reporting has been 
implemented--cross-referencing the applicable Federal Register 
notices--on the Exchange Network and Grants webpage at www.epa.gov/exchangenetwork.

IV. Major Changes From Proposed Electronic Reporting Provisions

A. How does the rule streamline the approval of electronic reporting 
under authorized state, tribe, and local government programs?

    1. Review of the proposal. EPA proposed that states, tribes, and 
local governmental entities would use the procedures for program 
revision or modification provided in existing program-specific 
regulations governing state, tribe, or local authorized programs.
    In the Preamble to the proposed rule, we noted that our approach 
raised certain administrative concerns, especially in cases where a 
governmental entity wished to use a single system to accept electronic 
submissions across a number of authorized programs, corresponding to 
EPA's use of CDX to receive reports across EPA programs. To receive EPA 
approval for such implementations, the governmental entity would have 
to apply for revision or modification under each authorized program 
affected, using procedures that might vary substantially from program 
to program. While these procedures might vary, each substantive review 
would still refer to the same proposed part 3 criteria, and--in the 
case of a single system implementation--would apply these criteria to 
the same system. EPA intended this approach to facilitate an 
administrative streamlining of the approval process, by allowing a 
single EPA review of all cross-program applications associated with a 
particular electronic document receiving system, which would enable EPA 
to make a single decision to approve or disapprove all the associated 
applications. While this approach would not eliminate multiple 
applications, it would at least simplify the interactions between the 
applicant and EPA during substantive review, and would speed EPA action 
on the applications themselves.
    EPA also considered more radical streamlining alternatives, 
including a centralized approval process provided for by regulation, 
and the proposal requested comment on whether any of these alternatives 
would be preferable to the administrative approach to streamlining.
    2. Comments on the proposal. In comments on the provisions for 
electronic reporting under authorized programs, a recurring theme was 
the complexity of the proposed requirements for EPA approval of program 
revisions or modifications to allow electronic reporting. The comments 
in many cases seemed directed equally to the approval process and to 
the proposed criteria for approval. Comments on the criteria are 
discussed in more detail in section IV.B.2 of this Preamble.
    As for the comments that clearly addressed the process, there were 
two major concerns. The first was that the process, due to the various 
current program authorization regulations, is inherently complicated, 
time-consuming and resource-intensive. In a few cases, commenters noted 
the particular worry that having to seek EPA approval for each program 
implementing electronic reporting would be especially burdensome, and 
that EPA's proposed approach of streamlining the internal review 
component of the program revision process would be of little help.
    The second concern was the impact of the rule on electronic 
reporting that was already underway. Commenters noted that many 
authorized programs are already accepting electronic submissions, or 
would be by the time the final rule is published, and they worried 
about the timing of the requirement that the electronic document 
receiving systems they use for this purpose be approved by EPA under 
associated program revision or modification procedures. Under the 
proposed provisions, such systems would have to be EPA-approved as soon 
as the rule became effective, which was not practicable. Given the need 
to address the criteria for approval, such applications could only be 
initiated once the rule was finalized, and they might take months to 
complete and get approved, or substantially longer in cases where the 
revision or modification required state legislative or regulatory 
changes. During the months or years that the revision or modification 
was in process, the authorized program would either have to shut down 
their electronic document receiving systems or, of necessity, operate 
them out of compliance with the rule. Commenters were particularly 
concerned with the disruptive impacts of having to shut these systems 
down. They pointed out that reversion to paper-based submissions in 
such cases may be difficult and expensive, both for the agencies and 
for the submitting entities that are affected, and that resuming

[[Page 59855]]

system operation after a long hiatus may require resources more 
typically associated with system start-up. Additional comments on 
program revision or modification and EPA's responses can be found in 
the rulemaking docket, in the Response to Comments document.
    3. Revisions in the final rule. To address the concern that the 
proposed program revision or modification to accommodate electronic 
reporting was too complicated and burdensome, the final rule provides 
streamlined procedures for adding electronic reporting to existing 
authorized programs. These are optional procedures that a state, tribe, 
or local government may use if it chooses, in place of the applicable 
program-specific procedures, to seek EPA approval for revisions or 
modifications that provide for electronic reporting. EPA believes that 
in most cases these optional procedures will be substantially simpler 
and quicker than their program-specific alternatives. These new 
procedures are discussed in detail in section VI.C of this Preamble.
    To address the concern that the required program revisions or 
modifications may disrupt authorized programs that already have 
electronic reporting underway, the final rule provides for a two-year 
delayed compliance date--in effect, a two-year ``grace period''--before 
such programs have to submit their applications for revision or 
modification. Programs will be allowed this grace period where they 
have systems that fit the definition of ``existing electronic document 
receiving system,'' explained in section VI.B.2 of this Preamble. In 
addition, these provisions allow the grace period to be extended, on a 
case-by-case basis, where an authorized program may need to wait for 
legislative or regulatory changes before a complete application can be 
submitted.

B. How has EPA revised the requirements that state, tribe, and local 
government electronic reporting programs must satisfy?

    1. Review of the proposal. EPA proposed a detailed set of criteria 
that would have to be met by any system that is used to receive 
electronic documents submitted to satisfy document submission 
requirements under any EPA-authorized state, tribe, or local 
environmental program. The proposed criteria addressed the capabilities 
that EPA believed a state, tribe, or local government's electronic 
document receiving system must have regarding six function-specific 
categories: (1) System security, (2) electronic signature method, (3) 
submitter registration, (4) signature/certification scenario, (5) 
transaction record, and (6) system archives.
    These criteria were based upon EPA's consideration of the roles 
that many electronically submitted documents will likely play in 
environmental program management, including compliance monitoring and 
enforcement, and the need to ensure that such roles were not 
compromised by the transition from paper to electronic submission. In 
many respects electronic submission enhances a document's utility for 
environmental programs: it significantly reduces the resources and time 
involved in making the content available to its users, and can greatly 
facilitate data quality assurance and analysis. Nonetheless, electronic 
submissions may also be open to challenge, primarily with respect to 
their authenticity, and particularly where they are used to establish 
the actions and intentions of the submitters. We normally consider such 
uses in the case of environmental reporting, especially where 
electronic submissions are made to report on an entity's compliance 
status and where the submission includes a responsible individual's 
certification to the truth of what is reported. For such cases, EPA 
identified a programmatic need to be able to authenticate the 
submission content and the certification--for example, to be able to 
address issues of fraud or false reporting where they arise--and it is 
primarily this need that was addressed by the six proposed criteria.
    The point of the proposal's six function-specific categories was to 
ensure the authenticity of electronic documents submitted in lieu of 
paper reports, so that they will be able to play the same role as their 
paper counterparts in providing evidence of what was reported and to 
what an identified individual certified with respect to the report. For 
example, in the case of paper submissions, the evidence surrounding a 
handwritten signature is normally sufficient to demonstrate that the 
signature is authentic and rebut any attempt by the signatory to 
repudiate it and EPA intends the standards in today's rule to provide 
evidence for electronic signatures that has a corresponding level of 
non-repudiation. Since these evidentiary issues typically arise in the 
context of judicial or other legal proceedings, electronic documents 
need the same ``legal dependability'' as their paper counterparts. The 
over-arching standard in the concept of ``legal dependability'' is that 
any electronic document that may be used as evidence to prosecute an 
environmental crime or to enforce against a civil violation should have 
no less evidentiary value than its paper equivalent. For example, where 
there is a question of deliberate falsification of compliance data--it 
must be possible to establish the signatory's identity beyond a 
reasonable doubt no matter whether the submission was electronic or 
paper.
    A seventh, more general proposed criterion, entitled ``Validity of 
Data,'' addressed the standard of legal dependability directly. The 
idea, in general, was that a system used to receive electronic 
documents must be capable of reliably generating evidence for use in 
private litigation, in civil enforcement proceedings, and in criminal 
proceedings in which the standard for conviction is proof beyond a 
reasonable doubt that the electronic document was actually signed by 
the individual identified as the signatory and that the data it 
contains was not submitted in error. The six more detailed, function-
specific criteria represented the requirements for satisfying this more 
general ``Validity of Data'' criterion. Taken together, the seven 
proposed criteria were intended to ensure the legal dependability of 
electronically submitted documents by providing:
     Standards for valid electronic signatures and authentic 
electronic documents to be admitted as evidence in a judicial 
proceeding;
     Assurance that electronic documents can be authenticated 
to provide evidence of what an individual submitted and/or attested to; 
and
     Assurance that electronic signatures resist repudiation by 
the signatory.

By providing for these and other facets of an electronic document's 
legal dependability, proposed CROMERR was intended to preserve the 
ability of EPA and its authorized programs to hold individuals 
accountable when they certify, attest or agree to the content of 
compliance reports under environmental laws and statutes. By the same 
token, proposed CROMERR was also intended to ensure that EPA and its 
authorized programs will have the documentary evidence they need to 
bring actionable cases of false or fraudulent reporting into court.
    2. Comments on the proposed criteria for electronic document 
receiving systems. EPA received a substantial number of comments on the 
proposed criteria for state, tribe, and local electronic document 
receiving systems, both in written submissions and at meetings with the 
public and with state and local government officials. While a

[[Page 59856]]

few of these comments questioned the ``Validity of Data'' criterion, 
the great majority dealt with the detailed function-specific criteria. 
There were at least three recurring and closely related themes. First, 
the criteria were too prescriptive and inflexible, and would prevent 
state, tribe, and local agencies from adapting their electronic 
reporting approaches to their needs and changing circumstances, and 
foreclose new and creative ways to achieve legal dependability. Second, 
the criteria would make electronic reporting unnecessarily complex, 
costly, and burdensome. Third, while the criteria might be appropriate 
for some cases, the ``one size fits all'' approach was not workable for 
all reports in all programs.
    Commenters tended to associate these three themes with certain 
misperceptions about the proposed requirements for signature method and 
the signature/certification scenario. Concerning signature method, a 
common concern was that the criteria would require states to implement 
PKI-based digital signatures. Commenters generally appear to have 
inferred this from proposed Sec.  3.2000(c) Electronic Signature 
Method, together with EPA's own choice of PKI for some submissions to 
CDX, as discussed in the Preamble. Whatever EPA's plans for CDX, state, 
tribe, and local government systems do not have to conform to the CDX 
model. Implementing a particular system of necessity requires the 
choice of specific technologies. To make those choices does not imply 
that these are the only possible choices that would satisfy whatever 
requirements the rule places on electronic reporting systems. 
Concerning Sec.  3.2000(c), commenters tended to focus on paragraph (5) 
of this section, which stated that the signature method had to ensure 
``that it is impossible to modify an electronic document without 
detection once the electronic signature has been affixed.'' EPA did not 
intend for this provision to establish PKI-digital signature as the 
required signature method. Given current technology, approaches to 
satisfying the Sec.  3.2000(c)(5) requirement frequently involve the 
computation of a number--called a ``hash''--that has a unique relation 
to the content of the electronic document such that any change to the 
document content would change the computed hash. Given the hash, the 
associated document can be confirmed as unmodified at any time by 
calculating a new hash and showing that the new and original hashes are 
identical. Using such a hash-based approach, it is important to ensure 
that the hash has been secured from tampering, and encryption is 
probably the most straightforward way to do this. Encryption can be 
accomplished in a number of ways. Approaches include PKI-based digital 
signature, digital signature where the asymmetric key-pair is not 
associated with a PKI certificate, and various forms of symmetric-key 
cryptography. Additionally, it may be possible to avoid cryptography 
altogether by storing the hash value in a system with appropriately 
controlled access. Thus, a solution using PKI-based digital signatures 
represents only one among a number of possible approaches to satisfying 
the proposed Sec. 3.2000(c)(5) requirement.
    A number of commenters also misinterpreted the criteria under 
proposed Sec.  3.2000(e) Electronic signature/certification scenario 
(especially the provisions for signatory's review of data under Sec.  
3.2000(e)(1)(i)) as requiring signatories to scroll through their 
submissions on-screen before they affix their electronic signatures, 
and requiring state systems to enforce this required ``scroll-
through''. However, the proposal provided not that the signatory must 
review the data on-screen, but rather that he or she be given the 
opportunity to do so. The example of the enforced on-screen ``scroll-
through'' then envisioned for CDX, and provided in the CDX section of 
the proposal's preamble, was in error. EPA did not intend to require 
this ``scroll-through'' of submitted data prior to signature. EPA 
certainly does expect and encourage reporting entities to review data 
intended for electronic submission prior to signature, but does not 
mandate this or any other particular mode or method of signatory review 
in today's rule.
    Returning to the three comment themes--of prescriptiveness, cost 
and burden, and a ``one size fits all'' approach--commenters who raised 
the prescriptiveness issue generally argued that, even supposing that 
there were no specific objections to the detailed Sec.  3.2000 
provisions, EPA had failed to make the case that every single 
requirement under these provisions is necessary to ensure the legal 
dependability of electronic submissions. Commenters who argued that the 
proposed rule would be too costly and burdensome generally focused on 
Sec.  3.2000(c)(5) and Sec.  3.2000(e)(1)(i), discussed above, or on 
the proposed Sec.  3.2000(d) registration and signature agreement 
provisions. There were many comments to the effect that the complex 
Sec.  3.2000(d) registration and re-registration requirements would 
pose substantial barriers to regulated company participation in 
electronic reporting and involve unacceptable expenses for implementing 
agencies. Commenters also noted that the required Sec.  3.2000(e)(1)(i) 
would be difficult to integrate with company workflow practices in many 
cases. Finally, there is the ``one size fits all'' issue. Some of the 
comments raised this as another version of the ``prescriptiveness'' 
issue, but adding that the proposal developed just one model of 
electronic reporting and attempted to make it fit the differing 
circumstances of the various state, tribe, and local agencies that 
would have to comply. Other comments emphasize the point that the 
proposal takes requirements apparently tailored to assuring an 
electronic document's authenticity and applies them to all cases of 
electronic reporting, whether or not the question of authenticity is 
likely to arise.
    EPA has considered these and related comments in writing today's 
rule. We do not wish to set overly prescriptive requirements and so 
foreclose acceptable electronic reporting alternatives that could offer 
equivalent or better assurance of legal dependability while, perhaps, 
being easier for a state, tribe, or local agency to implement. We do 
not wish to set requirements that impose unnecessary costs or burdens. 
And, while we do not see a ``bright line'' around the universe of cases 
where document authenticity might be of concern, we also do not wish to 
address authenticity with requirements that leave states, tribes, and 
local governments with too little flexibility in how they may adapt 
their electronic reporting implementations to their particular 
circumstances. Accordingly, EPA has decided to finalize criteria for 
electronic document receiving systems that directly articulate the 
underlying goal of assuring the legal dependability of electronic 
documents authenticity, and to add more specific requirements only to 
the extent that they are needed to achieve this underlying goal. 
Accordingly, the provisions of today's rule have been clarified as 
general performance standards necessary to ensure the legal 
dependability of the electronic documents they receive. Additional 
comments on the proposed criteria and EPA's responses can be found in 
the rulemaking docket, in the Response to Comments document.
    3. Revisions to the criteria in the final rule. In today's final 
rule, we intend to fulfill the underlying goal of the proposed Sec.  
3.2000 criteria for electronic document receiving systems. This is to 
assure the authenticity and non-

[[Page 59857]]

repudiation of electronic documents submitted in lieu of paper reports, 
so that they are as legally dependable--that is, as admissible in 
evidence and accorded the same evidentiary weight--as their paper 
counterparts. As noted earlier, this goal was expressed most directly 
in the proposed Sec.  3.2000(b) ``Validity of Data'' criterion. 
Accordingly, for the final rule, we started with the proposed Sec.  
3.2000(b) and then clarified the remaining proposed Sec.  3.2000 
criteria as general performance standards for electronic document 
receiving systems, which were incorporated as needed to assure the 
legal dependability of the electronic documents such systems receive. 
The resulting Sec.  3.2000(b) in the final electronic reporting rule 
reflects the requirements discussed in the table below. The citation 
for the corresponding language in the proposed rulemaking is also 
provided.

------------------------------------------------------------------------
                                          Citation/requirement in final
 Citation/subject area in proposed rule         section 3.2000(b)
------------------------------------------------------------------------
Proposed Sec.   3.2000(g), addressing    Section 3.2000(b)'s leading
 system archives.                         clause requires that the
                                          system be able to generate the
                                          required data as needed and in
                                          a timely manner.
Proposed Sec.  Sec.   3.2000(e)(3) and   Section 3.2000(b)'s leading
 3.2000(f), addressing signature/         clause and Sec.   3.2000(b)(4)
 certification scenarios and              require that the system be
 transaction record.                      able to generate a ``copy of
                                          record'' that is made
                                          available to the submitters
                                          and/or signatories for review
                                          and repudiation.
Proposed Sec.  Sec.   3.2000(c) and      Section 3.2000(b)(5)(i)
 3.2000(d), addressing the electronic     requires that the system be
 signature method and submitter           able to show that any
 registration process.                    electronic signature on an
                                          electronic document was
                                          created by an authorized
                                          signatory with a device that
                                          the identified signatory was
                                          uniquely entitled and able to
                                          use.
Proposed Sec.   3.2000(c)(5),            Section 3.2000(b)(5)(ii)
 addressing requirement that it be        requires that the system be
 impossible to modify an electronic       able to show that the
 document without detection once it has   electronic document cannot be
 been electronically signed.              altered without detection once
                                          it has been electronically
                                          signed.
Proposed Sec.   3.2000(e), addressing    Sections 3.2000(b)(5)(iii)--
 the signature/certification scenario.    (iv) require that the system
                                          be able to show that, before
                                          signing, any signatory had the
                                          opportunity to review what he
                                          or she was certifying to in a
                                          human-readable format, and to
                                          review the certification
                                          statement including any
                                          provisions relating to
                                          criminal penalties for false
                                          certification.
Proposed Sec.   3.2000(d), addressing    Section 3.2000(b)(5)(v)
 the submitter registration process.      requires that the system be
                                          able to show that the
                                          signatory signed an
                                          ``electronic signature
                                          agreement'' or a ``subscriber
                                          agreement'' acknowledging his
                                          or her obligations connected
                                          with preventing the compromise
                                          of the signature device.
Proposed Sec.   3.2000(e)(2),            Section 3.2000(b)(5)(vi)
 addressing acknowledgment.               requires that the system be
                                          able to show that it
                                          automatically sent an
                                          acknowledgment of any
                                          electronic submission it
                                          received that bears an
                                          electronic signature; the
                                          acknowledgment must identify
                                          the electronic document, the
                                          signatory and the date and
                                          time of receipt, and be sent
                                          to an address that does not
                                          share the access controls of
                                          the account used to make the
                                          submission.
Proposed Sec.   3.2000(d)(1)-(3),        Section 3.2000(b)(5)(vii)
 addressing submitter registration..      requires, for each electronic
                                          signature device used create
                                          an electronic signature on
                                          documents that the system
                                          receives, that the system be
                                          able to establish the identity
                                          of the individual uniquely
                                          entitled to use that device
                                          and his or her relation to the
                                          entity on whose behalf he or
                                          she signs the documents.
------------------------------------------------------------------------

    The requirements in Sec.  3.2000(b)(5)(iii)-(iv) of today's rule, 
concerning ``opportunity to review,'' do not place the responsibility 
for providing an opportunity, or for showing whether or not an 
opportunity was actually taken, on the state, tribe, or local 
government electronic document receiving system. What is required is 
that the system provide evidence sufficient to show that an opportunity 
was provided; this point is explained in greater detail in sections 
VI.E.8 and VI.E.9 of this Preamble.
    EPA believes that the standards in Sec.  3.2000(b) of today's rule, 
as developed from the proposed ``Validity of Data'' criterion, together 
with other proposed criteria clarified as general performance 
standards, represent the minimum set of requirements for electronic 
document receiving systems necessary to ensure the legal dependability 
of the electronic documents such systems receive. For example, the 
requirement for a copy of record is necessary to ensure that there is 
an authoritative answer to the question of what information content a 
signatory was certifying to or attesting to. The related requirement 
that the system be able to provide timely access to copies of record 
and related data reflects a practical concern that the data be 
accessible in time and in a format to serve the purposes for which it 
is needed.
    Concerning the requirement that signature devices be uniquely 
assigned to, and held by individuals, EPA believes that an acceptable 
electronic document receiving system must be able to attribute a 
signature to a specific individual, to help assure that the signatory 
cannot repudiate responsibility for the signature. Non-repudiation is 
also strengthened by the signed electronic signature agreement, which 
establishes that the signatory was informed of his or her obligation to 
keep the signature device from compromise by ensuring that it is not 
made available to anyone else. Requiring the signature agreement, as 
well as the opportunity to review what they are signing, helps 
establish that where signatures appear on electronic documents, the 
signatories had the requisite intent to certify. That is, these 
requirements help ensure that the signatories knew what they were 
signing, knew what signing meant, and understood the legal implications 
of false certification. As for the requirement that document content 
cannot be altered without detection after signature, an acceptable 
electronic document receiving system must provide evidence sufficient 
to allow a court to attribute the intention to certify to the 
document's current content to the signatory, so that he or she cannot 
repudiate this content.
    Finally, today's Sec.  3.2000(b)(5)(vii) requirement that the 
system be able to establish the identity of the individual who is 
assigned a signature is based on proposed Sec.  3.2000(d). Proposed 
Sec.  3.2000(d) logically entails today's Sec.  3.2000(b)(5)(vii), 
because satisfying the

[[Page 59858]]

provisions of the former guarantees compliance with the latter. 
However, today's Sec.  3.2000(b)(5)(vii) limits the scope of the 
proposed Sec.  3.2000(d)(3) requirement that, in registering for their 
signature devices, registrants must execute their electronic signature 
agreements on paper with handwritten signatures. In today's Sec.  
3.2000(b)(5)(vii), this requirement is limited to a special class of 
``priority report'' submittals. (See section VI.E.12 of this Preamble.) 
In addition, today's Sec.  3.2000(b)(5)(vii) offers alternatives to 
this handwritten signature requirement, to allow electronic reporting 
solutions that are completely free of paper transactions. The 
alternative provisions, found in today's Sec.  3.2000(b)(5)(vii)(A)-
(B), are elaborations of the proposed Sec.  3.2000(d)(1) requirement 
for ``evidence [of identity] that can be verified by information 
sources that are independent of the registrant and the entity or 
entities'' for which the registrant will submit electronic documents. 
The elaborations are necessary to assure that individuals' identities 
can be established without being able to rely on their handwritten 
signatures--and, in the final rule, the requirements apply only to 
``priority report'' submittals, and only where the choice is made to 
not use paper in the execution of electronic signature agreements. 
Section VI.E.12 of this Preamble outlines all of today's Sec.  
3.2000(b)(5)(vii) provisions in much more detail. In any event, we have 
made these changes to the proposed Sec.  3.2000(d) approach to help 
address commenters' concerns with ``one size fits all'' provisions, as 
well as to allow states, tribes, and local government as much 
flexibility as possible as they implement their electronic reporting 
systems.
    In sum, the overall approach to the standards for electronic 
document receiving systems in today's rule reflects a balancing of the 
concerns raised by the public comments, especially those relating to 
the proposal's burden on states, tribes, local governments and 
regulated entities, against the need to ensure the legal dependability 
of electronic documents submitted under authorized programs. Finally, 
EPA notes that to date the Agency has had limited experience with the 
practical application of electronic signatures and electronic reporting 
generally. With the benefit of practical experience accepting 
electronic reports under this rule, EPA may determine that this rule 
needs to be revisited, to either add or eliminate certain safeguards. 
In addition, while EPA has sought to write this rule so that its 
provisions are technology-neutral, it remains possible that revisions 
will be required to reflect technological changes or changes in 
prevailing industry norms and practices. If these or other 
circumstances require it, EPA thus reserves the right to revisit the 
issues addressed in this rule.

C. How has EPA accommodated electronic submissions with follow-on paper 
certifications?

    Currently there are EPA and state programs that take electronic 
submissions where the requirements for a signed certification statement 
are met with a follow-on paper submission with handwritten signatures. 
A number of commenters suggested that such an approach be recognized 
and allowed to continue under the electronic reporting rule. EPA has no 
wish to proscribe such an approach, and does not judge whether or not 
follow-on paper signature/certification is to be preferred to the 
approach where the signature/certification is electronic. To make this 
clear in the final rule, we have added a clause to Sec.  3.10(b) that 
allows follow-on handwritten signatures to substitute for electronic 
signatures on submissions to EPA where ``EPA announces special 
provisions'' for this purpose. A corresponding clause in Sec.  
3.2000(a)(2) of today's rule makes a similar allowance for electronic 
reporting under authorized state, tribe, or local programs, again, 
where ``the program makes special provisions to accept a handwritten 
signature on a separate paper submission.''
    Among other things, these ``special provisions'' would allow 
follow-on paper signature submission only if it were reliably linked or 
cross-referenced with the associated electronic document. The linking 
or cross-referencing is necessary in part to ensure that we can always 
determine which signature submissions belong with which electronic 
documents. Paper signature submissions must also provide sufficient 
evidence that the signatory intended to certify to or attest to the 
content of the electronic document as this content is recorded in the 
copy of record for the submission. There are various approaches to 
cross-referencing or linking that would meet these needs, most of which 
involve the inclusion of extra data elements in the signature 
submission that reference the associated electronic document. Such data 
elements might include summary data from the electronic document, the 
date and time of the electronic submission, or even the calculated hash 
value of the electronic document. EPA may use these and other 
alternatives if a decision is made to provide for direct electronic 
reporting to EPA with follow-on paper signatures. For such submissions 
to authorized programs, we have added to Sec.  3.2000(a)(2) of today's 
rule the requirement that authorized program provisions for follow-on 
paper signature submissions ``ensure that the paper submission contains 
references to the electronic document sufficient for legal certainty 
that the signature was executed with the intention to certify to, 
attest to, or agree to the content of that electronic document.''

D. How has EPA changed proposed definitions of terms?

    The ``Definitions'' section of the final rule, Sec.  3.3, provides 
new definitions for ``copy of record,'' ``electronic signature 
agreement,'' and ``valid electronic signature,'' as well as the 
revisions to the definition for ``electronic signature device,'' to 
help articulate the final Sec.  3.2000(b) standards for electronic 
document receiving systems. These terms are explained in more detail in 
section VI, below. (See especially, sections VI.E.2., VI.E.10. and 
VI.E.6.) Similarly, in section VI.B.2 of this Preamble we note the role 
of the new definition for ``existing electronic document receiving 
system;'' and, in section VI.E.12 we discuss the new definitions for 
``agreement collection certification,'' ``disinterested individual,'' 
``information or objects of independent origin,'' ``local registration 
authority,'' ``priority reports,'' and ``subscriber agreement.'' 
Section 3.3 also reflects a number of clarifying and/or simplifying 
changes for definitions of terms, as follows.
    1. Definition of ``acknowledgment.'' This definition has been added 
in conjunction with Sec.  3.2000(b)(5)(vi) of today's rule, to make 
clear that in the context of this rule, acknowledgment means a 
confirmation of electronic document receipt.
    2. Definition of ``electronic document.'' This definition has been 
revised from the proposed version in several ways. First, the use of 
``communicate'' has been eliminated, thereby eliminating the need for a 
separate definition of that term. Second, the exclusion of magnetic and 
optical media and facsimile submissions has been eliminated. We believe 
it is clearer to exclude such submissions from the scope of CROMERR 
under Sec.  3.1, entitled ``Who does this part apply to?'' Today's rule 
now provides this exclusion in Sec. Sec.  3.1(b) and 3.1(c). Third, the 
definition has also been revised so that it explains what a 
``document'' is in an electronic medium. Instead of saying that an 
``electronic document means a

[[Page 59859]]

document. * * *,'' the final version says that ``electronic document 
means any information in digital form. * * *,'' where information is 
explained as potentially including ``data, text, sounds, codes, 
computer programs, software or databases.'' Fourth, this definition 
clarifies that in this context, ``data,'' is used in its normal sense 
as denoting a delimited set of data elements, each of which is a unit 
of meaning in a document and consists of a content or value together 
with an understanding of what the meaning and/or context of the content 
or value is. Finally, the definition stipulates that where an 
electronic document includes data, the understanding of what the data 
content or value means must either be explicitly included in the 
electronic document or be readily available through such sources as an 
applicable data element dictionary, or a form or template that 
specifies what each data element means when it is presented in the 
specific file format used for the electronic document's submission.
    A consequence of this approach is that the identity of an 
electronic document consisting wholly of data is independent of the 
format in which it is presented or submitted. That is to say, 
rearranging or reformatting the data elements in an electronic document 
does not change it into a different one, at least so long as the 
signatory's intention and understanding of what the data elements each 
mean is preserved in the process. This does not conflict with the 
ordinary understanding of the term ``document,'' since we speak quite 
often of ``reformatting a document,'' with the clear understanding that 
what results will be the same document in a new format. 
Correspondingly, under the definition of ``copy of record,'' a ``true 
and correct'' copy of an electronic document does not necessarily have 
to reflect the format in which the document was submitted, provided 
that the document consists wholly of data. This independence of 
document identity from format may not always hold where other kinds of 
information are included in the electronic document, e.g. text or 
images; in such cases a copy of record may have to include format or 
formatting information.
    3. Definition of ``electronic signature.'' This definition has been 
revised by substituting ``information in digital form'' for 
``electronic record,'' to avoid problems with defining ``electronic 
record.'' The definition has also been revised to make clear that the 
electronic signature for an electronic document need not always be 
``included'' within that document; in some cases it may just be 
``logically associated'' with it. This point is explained further in 
section VI.E.2 of this Preamble, in discussing the copy of record 
requirement.
    4. Definition of ``electronic signature device.'' The definition of 
``electronic signature device'' has been revised to clarify that where 
a device is used to create an individual's electronic signature, then 
the device must be unique to that individual, and he or she must be 
uniquely entitled to use it at the time that the signature is created. 
Correspondingly, the device is compromised if it is available for use 
by any other individual, that is, if some other individual is able to 
use the device to create signatures if he or she wishes. To the extent 
that Sec. Sec.  3.10(b) and 3.2000(b)(5)(i) of the final rule prohibit 
the acceptance of signatures created with compromised devices, via the 
definition of ``valid electronic signature,'' the element of compromise 
rules out the sharing of electronic signature devices or delegating 
their use to create individuals' electronic signatures. Additionally, 
the definition includes the element that an individual needs to be 
entitled to use the electronic signature device; that is, the 
individual needs to be the ``owner'' of the device. The nature of the 
device itself will determine the way in which an individual comes to 
own it. In the case of personal identification numbers or certificate-
based private/public key pairs, there is normally some process of 
formally assigning the device to the individual, often through a 
trusted third party. In other cases, for example password or personal 
information-based signature devices, the process may have the 
individuals invent and assign the devices to themselves `` the basis 
for their ownership of the devices being determined by the 
circumstances or context within which they do this.
    5. Definition of ``transmit.'' In the proposed rulemaking the term 
``submit'' was defined as the ``means to successfully and accurately 
convey an electronic document so that it is received by the intended 
recipient in a format that can be processed by the electronic document 
receiving system.'' However, the term ``submit'' is used more widely in 
the rule in ways that are not consistent with this definition. 
Accordingly, in the final rule the function of successful and accurate 
conveyance of an electronic document is now termed ``transmit.''
    6. Definition of ``valid electronic signature.'' Beyond its role in 
Sec.  3.2000(b), this definition has also been added to help clarify 
and simplify the signature requirements associated with electronic 
reporting, both directly to EPA, in Sec.  3.10, and under authorized 
programs, in Sec.  3.2000(a)(2). The definition specifies three main 
conditions for validity. The first refers to features of the signature 
that are intrinsic to the items of information of which it consists: 
The signature must consist of the kind of information that has been 
established as appropriate for the signing of the document in question, 
and the specific information content must pass the validation tests 
which the system uses to determine that the signature belongs uniquely 
to the identified signatory. The second condition refers to the status 
of the electronic signature device used to create the signature, and 
ensuring that the device was not compromised at the time it was used to 
create the signature. This ties validity to the element of compromise 
within the definition of ``electronic signature device.'' That is, at 
the time of signature, the device must not have been made available to 
someone other than the individual who is entitled to use it. The third 
condition refers to the signatory's status at the time of signature as 
someone who is authorized to sign the document in question by virtue of 
his or her legal status and/or relationship to the entity on whose 
behalf the signature is executed. In the context of environmental 
reporting, this condition would make invalid electronic signatures on 
company compliance reports created by individuals who do not work for 
or in any way represent the company. Generally, in the context of 
environmental reporting, individuals who sign submissions to 
environmental agencies are explicitly authorized to do so, by their 
management and/or by the agency to which they report. However, in some 
cases the authorization may be implicit in the signatory's legal status 
and relationship to the regulated entity. For example, an owner or 
operator of a company is generally authorized to sign notifications or 
letters to an environmental agency whether or not this is explicitly 
provided for by law or regulation.
    As ``valid electronic signature'' is used in Sec. Sec.  3.10 and 
3.2000(a)(2), the validity of an electronic signature is necessary for 
the signatory's electronic submission to satisfy a federal or 
authorized program reporting requirement. Additionally, as the term is 
used in Sec.  3.2000(b), it also refers to a performance requirement 
for an electronic document receiving system, namely that the system 
must not accept and must be able to detect submissions with signatures 
that are not valid. These requirements in terms of ``validity'' are

[[Page 59860]]

meant to provide a form of insurance for electronic signatures to 
protect against the risks of repudiation. Nonetheless, a signatory may 
be legally bound by a signature even where not all the requirements for 
its validity have been met, e.g., where the signature has been executed 
with a compromised electronic signature device. The signatory of an 
electronic submission cannot avoid responsibility for its contents by 
pointing to a technical flaw or other defect in the signature process.

V. Requirements for Direct Electronic Reporting to EPA

A. What are the requirements for electronic reporting to EPA?

    Under the final rule, the requirements for electronic reporting to 
EPA remain essentially unchanged from those in the proposal. Section 
3.10 provides, first, that electronic documents must be submitted to an 
appropriate EPA electronic document receiving system. Generally this 
will be EPA's Central Data Exchange (CDX), although EPA can also 
designate additional systems for the receipt of electronic documents 
and is doing so in a separate Federal Register notice. Second, where a 
paper document must bear a signature under existing regulations, an 
electronic document that substitutes for the paper document must be 
signed (by the person authorized to sign under the current applicable 
provision) with a valid electronic signature.
    Only electronic submissions that meet these two requirements will 
be recognized as satisfying a federal environmental reporting 
requirement, although failure to satisfy these requirements will not 
preclude EPA from bringing an enforcement action based on the 
submission or otherwise relying on the submission. A new compliance and 
enforcement section has been added to the final rule to clarify certain 
compliance and enforcement issues related to electronic reporting. 
Section 3.4 makes clear that EPA can seek and obtain any appropriate 
federal civil or criminal penalties or other remedies for failure to 
comply with an EPA reporting requirement if a person submits an 
electronic document to EPA under this rule that fails to comply with 
the provisions of Sec.  3.10. Similarly, Sec.  3.4 makes clear that EPA 
can seek and obtain any appropriate federal civil or criminal penalties 
or other remedies for failure to comply with a state, tribe, or local 
government reporting requirement if a person submits an electronic 
document to a state, tribe, or local government under an authorized 
program and fails to comply with the applicable provisions for 
electronic reporting. Section 3.4 also contains provisions originally 
published under Sec.  3.10(d) and (e) of the proposal, stipulating that 
the electronic signature will make the person who signs the document 
responsible, bound, or obligated to the same extent as he or she would 
be signing the corresponding paper document by hand.
    The Sec.  3.10 requirement that there be an electronic signature 
applies only where a paper document would have to bear a signature were 
it to be submitted, either because this is required by a statute or 
regulation, or because a signature is required to complete the paper 
form. The rule does not impose any new or additional signature 
requirements for documents that are submitted in electronic form. In 
addition, as noted in section IV.C of this Preamble, Sec.  3.10(b) of 
today's rule also allows EPA to make special provisions, in specific 
cases, for accepting handwritten signatures in follow-on paper 
submissions in lieu of the required electronic signatures. In such 
cases, it is critical that the special provisions ensure that the 
electronic document cannot be altered without detection and is reliably 
linked to the handwritten signature.
    As in the proposal, this final rule does not specify any required 
hardware or software. Accordingly, the rule text does not include any 
detail about CDX per se or about what will be required of regulated 
entities who wish to use it. Nonetheless, as stated in the proposal, 
our goals include the sharing of detail on how CDX implements direct 
electronic reporting to EPA. Section V.C.4 of this Preamble explains 
how CDX has changed since we described it in the proposal, especially 
in relation to the many comments we received on CDX-related issues.

B. What is the status of existing electronic reporting to EPA?

    In a notice published concurrently with today's rule, EPA clarifies 
the status of electronic reporting directly to EPA systems that exist 
as of the rule's publication date. In accordance with 40 CFR 3.10, EPA 
is designating for the receipt of electronic submissions, all EPA 
electronic document receiving systems currently existing and receiving 
electronic reports as of the date of this notice. This designation is 
valid for a period of up to two years from the date of publication of 
this notice. During this two-year period, entities that report directly 
to EPA may continue to satisfy EPA reporting requirements by reporting 
to the same systems as they did prior to CROMERR's publication unless 
EPA publishes a notice that announces changes to, or migration from, 
that system. Any existing systems continuing to receive electronic 
reports at the expiration of this two-year period must receive 
redesignation by the Administrator under Sec.  3.10. Notice of such 
redesignation will be published in the Federal Register.
    EPA's goal is that all its systems for receiving electronic reports 
be consistent with the CROMERR standards for electronic document 
receiving systems, set forth in Sec.  3.2000(b) of today's rule. EPA 
generally hopes to achieve this consistency within a two-year 
transition period for existing EPA systems; however, EPA is not bound 
by the Sec.  3.2000(b) standards of today's rule or the two-year 
period. This two-year period is similar to the two-year transition 
period provided under Sec.  3.1000(a)(3) for systems operated under 
EPA-authorized programs. In a number of cases, EPA may work toward this 
goal by migrating existing electronic reporting to CDX or to other, new 
CROMERR-consistent systems. As we change or migrate existing electronic 
reporting programs to achieve consistency with the CROMERR standards, 
we intend to provide sufficient advance notice to reporting entities so 
that any new requirements can be accommodated without causing 
significant disruption to their electronic reporting activities.

C. What is EPA's Central Data Exchange?

    1. Overview of general goals. The proposal described EPA's 
``Central Data Exchange'' as a system to be developed and maintained by 
EPA's Office of Environmental Information (OEI) that would serve as 
EPA's gateway or ``portal'' for receiving documents electronically from 
our reporting community. The goal of CDX was to augment, and, where 
appropriate, streamline and consolidate EPA's environmental reporting 
functions by offering our reporting community faster, easier, and more 
secure submission options through a single venue for electronic 
submission of environmental data. As a cornerstone of EPA's efforts to 
advance electronic government, CDX would support the electronic 
submission needs of thousands of regulated entities submitting data to 
EPA for certain air, water, waste, and toxic substances programs. 
Ultimately, EPA planned to offer, wherever practicable, all regulated 
entities that report directly to EPA, an option to file their specific 
environmental documents

[[Page 59861]]

electronically through CDX. Regulated entities that submit reports 
under an authorized program would also be able to file their documents 
through CDX in cases where the state, tribe or local government that 
administered the program chose to use CDX as a gateway for electronic 
data submissions from its reporting community.
    The reporting community using CDX would be able to access web 
``reporting'' forms with built-in data quality checks, and/or submit 
standard file formats through common, user-friendly interfaces that 
allowed them to electronically submit data across vastly different 
environmental programs. Both the reporting community and EPA would 
benefit by gaining access to environmental reports more quickly and 
with fewer errors, and by avoiding the inefficiencies of having to 
keystroke data from paper reports. CDX was also being developed to 
support a newly emerging Environmental Information Exchange Network 
(EIEN) that would facilitate the electronic exchange of environmental 
data between EPA and state, tribe, and local environmental agencies. 
However, in keeping with the scope of the proposed rule the description 
of CDX features and functions in this section apply only to electronic 
submissions to CDX from regulated entities; the description doesn't 
apply to EIEN exchanges with CDX in which states, tribes, or local 
governments participate as a part of their authorized programs or as a 
part of administrative arrangements with EPA to share data.
    The Concept of Uniformity. The proposal also characterized CDX as 
providing an environment that would promote a uniformity of 
technologies and processes. By adopting CDX to support the electronic 
reporting needs across various EPA programs, EPA hoped to avoid the 
proliferation of program-specific electronic reporting approaches that 
could lead to duplicative investments in electronic document receiving 
systems and possibly conflicting requirements for submitters.
    The CDX Functions and Building Blocks. As described in the proposed 
rule, CDX was being designed with the goal of fully satisfying the 
criteria that the proposal specified for state, tribe, and local 
electronic document receiving systems; similarly, EPA would ensure that 
other systems the Administrator designated to receive electronic 
submissions satisfied the criteria as well. The proposal discussed how 
CDX would implement CROMERR-compliant electronic reporting by 
describing the primary CDX functions and the system building blocks 
that would support these functions. The functions described in the 
proposal included: (1) Access management, (2) data interchange, (3) 
signature/certification management, (4) submitter and data 
authentication, (5) transaction logging, (6) copy of record provisions 
and acknowledgment, (7) archiving, (8) error checking, (9) translation 
and forwarding, and (10) outreach. The proposal then described five 
building blocks that would support CDX functions, which were: (1) 
Digital signatures based on PKI, where CDX would rely predominately on 
a third party vendor under the General Services Administration (GSA) 
Access Certificates for Electronic Services (ACES), (2) a process for 
registering users and managing their access to the CDX, (3) a client 
server-architecture, (4) EDI standards, as the primary format for 
exchanging environmental data, and (5) a consistent user interface for 
making electronic submissions.
    2. Comments on the proposal. EPA received more than 100 comments on 
the CDX concept as described in the proposal. A number of these 
comments were related to one of four main subject areas, as follows.
    Comments on Uniformity of Approach. Several comments expressed 
concern about the proposed characterization of CDX as promoting 
``uniformity of process and technology''. The phrase was used to 
highlight the benefits of CDX, which included EPA's plans to avoid the 
costly proliferation of redundant systems. However, comments pointed 
out that this ``uniformity'' implied an inflexible and overly 
prescriptive set of CDX technical and security requirements, which 
would discourage CDX use. Such comments were similar to those discussed 
in section IV.B.2 of this Preamble, raising concerns about the 
prescriptiveness and ``one size fits all'' approach of the proposed 
criteria for electronic document receiving systems.
    EPA understands that ``uniformity of process and technology'' could 
imply inflexibility, and this is not generally how we intended to 
develop CDX. In fact, CDX is currently using a wide range of 
technologies and processes to address CDX's functions that are tailored 
to individual EPA program submission requirements, including the 
technical capabilities of the reporting community for the particular 
program. EPA recognizes that, for example, permitting, compliance 
monitoring, and the conduct of studies involve fundamentally different 
business processes, and that the associated submission of electronic 
documents may have to be handled differently in each case. In some 
instances CDX may support a more interactive ``workflow'' environment 
for submitting data; in others, CDX may accept batch transmissions of 
user-formatted files. It is also true that the technical capabilities 
of a particular reporting community vary considerably, so CDX will 
offer more than one electronic submission option in many cases. CDX 
currently provides support for web-forms, file, and record-level 
submissions in various formats including flat file and XML and EPA 
plans to continue this flexible approach.
    Comments on registration process. Comments from regulated entities 
raised concerns about the costs and time required to register 
individuals in each company, and EPA's failure to address the 
increasingly common cases where the preparer of an environmental report 
and the certifying official are different individuals.
    Because electronic submission is being offered as an option to the 
reporting community, EPA recognizes the need to design CDX registration 
to be as user-friendly as practicable, in part by taking account of the 
flow of work, or ``workflow'' involved in meeting a particular 
environmental reporting requirement. For example, since proposal, EPA 
has developed approaches to register both preparers and certifying 
officials for at least two reporting programs. Changes to the CDX 
registration process are discussed in more detail in section V.C.4.
    Comments on digital signatures based on PKI. Comments pointed out 
that reliance on PKI for all cases of electronic signature may violate 
the GPEA directive to vary electronic signature approaches with the 
circumstances of their use. Several comments underlined this concern by 
pointing to PKI's costs and burdens. The comments objected that 
registering through CDX and acquiring digital signature certificates 
would be overly complicated, and would require that registrants provide 
private or personal information. Some comment also expressed concern 
about the incompatibility of a PKI-based approach with workflow, given 
that environmental reports were frequently prepared by staff and then 
signed by the facility owner, with staff turnover being frequent. 
Another concern was the implications of CDX PKI software for company 
system security, for example, given the need to download CDX software 
through the company firewall.
    EPA agrees that it should generally minimize the complexity and 
cost of electronic signatures or this will deter potential users of CDX 
from submitting

[[Page 59862]]

electronic documents. In implementing CDX, EPA has revised the initial 
plan for electronic signatures to include non-PKI electronic 
signatures. Section V.C.4 discusses how we are changing the ``digital 
signature based on PKI building block.''
    Comments on EDI Standards. Comments expressed both encouragement 
and concern over CDX's prospective implementation of standards-based 
exchange formats for data submissions. An exchange format is a 
predefined file structure, including data elements and higher level 
syntax that describes how the data extracted from a system must be 
arranged in a file for transmission to another system. A standards-
based format adheres to certain widely-accepted industry, national, or 
international file structure definitions. Several comments expressed 
concern about the costs of configuring their systems to generate a CDX-
specified standard format; others expressed concerns about the costs of 
potential changes to the format once it is implemented on their 
systems. By contrast, other comments strongly supported requiring 
standards-based formats--even recommending that we require such formats 
by rule for EPA and EPA-authorized state, tribe, and local electronic 
document receiving systems.
    CDX's approach to standards-based formats has changed considerably 
since the proposal, in large part because of the emergence of Internet-
based approaches, most notably Extensible Mark-up Language (XML). These 
changes are discussed in more detail in section V.C.4. EPA believes 
that the use of standard formats can be encouraged without requiring 
this by rule. Additional comments on CDX and EPA's responses can be 
found in the rulemaking docket, in the Response to Comments document.
    3. The aspects of CDX that have not changed since proposal.
    General Goals. EPA's continues its efforts to establish CDX as the 
gateway or ``portal'' for receiving documents electronically from the 
Agency's reporting community. In so doing, EPA's goal--to augment, and 
where appropriate, to streamline and consolidate EPA's environmental 
reporting functions through CDX--remains unchanged. The functions that 
comprise CDX operations continue to remain the same though the range of 
technologies and processes used to support these functions has 
considerably broadened. CDX continues to implement electronic reporting 
capabilities for EPA's many environmental programs, while advancing the 
efforts of EIEN in coordination with state, territorial, tribes, and 
other partners.
    General Approach to Electronic Reporting Implementation. In 
general, current instructions for client-side access of CDX suggest 
Internet access and a system that uses both Microsoft Windows and 
Microsoft Internet Explorer (IE). EPA acknowledges that the Government 
Paperwork Elimination Act (GPEA) directs OMB to develop procedures for 
agencies to follow in using and accepting electronic documents and 
signatures and these procedures ``may not inappropriately favor one 
industry or technology.'' Consistent with this GPEA directive, EPA is 
committed to considering ways to allow other vendors' technologies to 
access CDX. Accordingly, over the six months following the publication 
of today's rule, EPA intends to assess the full range of issues that 
affect CDX's ability to support multiple platforms and browsers. These 
issues include the technical requirements for the electronic signature 
options, form entry options, data upload options, network interface 
options, current capabilities of the CDX hardware/software platform, 
and potential impacts of new client-side platforms on the CDX life 
cycle management, technical support requirements, and help desk 
training and support. Based on this assessment, EPA intends to 
determine the target universe of client-side platforms and browsers 
that CDX can feasibly accommodate, and will identify the actions and 
timeline necessary to build out CDX support for this target universe.
    As described in the proposal, CDX users will need to:
     Register with CDX, during which time they may need to 
supply information used to identify themselves, their company, and the 
EPA documents they wish to submit electronically;
     Verify and/or correct registration information; and
     Access their CDX web account through a secure website, and 
agree to the terms and conditions of using the site, which include 
safeguarding their self-generated password, before using web forms or 
uploading files to submit electronic documents or data to EPA.

These are the minimum steps for gaining access to CDX at this time. 
Additional steps are involved in acquiring an electronic signature 
device, although these steps have changed somewhat since the proposal 
and are discussed in section V.C.4. CDX also offers at least two 
general methods for reporting electronically for many programs it 
supports, either through file submission or through a ``smart web 
form''. However, the types of formats and approaches for submitting 
data through CDX have broadened, and these too are discussed in section 
V.C.4.
    4. The major changes that EPA has made to CDX since proposal. Over 
the last two years, CDX has evolved from a prototype system to a fully 
operational electronic document receiving system. CDX supports tens of 
thousands of registered users providing data to dozens of environmental 
reporting programs across the major EPA media offices. CDX registered 
users include representatives from state, tribe, and local agencies, 
industries, laboratories, and other federal agencies. While CDX 
continues to provide a secure, single point of registration, access, 
and exchange between reporting entities and EPA programs, the building 
blocks supporting the CDX functions have changed substantially. These 
changes reflect EPA's experience operating CDX over the past two years, 
evolving trends in Internet technologies, and comments received on the 
proposed rule from potential CDX users.
    Digital signatures based on PKI. The proposal described the CDX 
approach to electronic signatures in terms of digital signatures and 
PKI. Since proposal, EPA has come to appreciate the complexity and 
costs of implementing PKI, and to recognize that non-PKI electronic 
signatures, as described in section IV.B.2 of the preamble today's 
rule, may be acceptable in many cases. Thus, for electronic reports 
currently submitted to CDX, only in one case is PKI used for electronic 
signature. The other cases involve PIN-based electronic signatures or 
other non-PKI electronic signature approaches. As an example of the 
latter, this year we anticipate implementing electronic signatures for 
an EPA reporting requirement by having signatories use a password that 
is self-generated during CDX registration in combination with certain 
items of information that are unlikely to be available to anyone except 
the signatory. This is a ``knowledge-based'' approach, which is being 
used extensively by commercial software vendors supporting the United 
States Internal Revenue Service (IRS) for electronic tax filings or 
``e-filings', and is being adopted by other agencies. EPA expects that 
these non-PKI-based approaches to signature will continue to dominate 
CDX implementations of electronic reporting. We currently intend to use 
PKI where such needs as security or assuring very robust non-
repudiation of signature make this the most appropriate approach.

[[Page 59863]]

    In addition, EPA's approach to PKI itself--described in the 
proposal as relying on ACES--is also undergoing change. Changes with 
respect to the role and method of identity proofing for those persons 
who apply for PKI certificates is being further evaluated. As proposed, 
the identity proofing was to be conducted by the third party ACES 
vendor; currently, CDX identity proofing is conducted for the most part 
by EPA's own contractor staff, who are able to issue digital 
certificates to members of the reporting community with less cost and 
in less time than the ACES vendor. EPA has also begun to explore 
alternatives to ACES for PKI certificates, partly because ACES-provided 
certificates do not support message encryption, which EPA may need for 
certain environmental reporting applications. In addition, EPA is 
considering its use of ACES in the light of recent federal advances in 
establishing interoperability across federal PKI domains, which may 
allow EPA to eventually leverage PKI's of other federal agencies or 
institute an in-house PKI.
    CDX Registration. Since the proposed rule, CDX has broadened it 
approach to registration to better accommodate the workflow involved in 
specific environmental reporting programs. While CDX still requires 
registration, there are three distinct areas where the registration 
process has changed since proposal. First, the proposal described CDX 
registration as the first step toward the issuance of a PKI-based 
digital signature, and it was implied that all persons opting to use 
CDX would need a digital signature. As noted above, this is no longer 
the case. Second, in the proposal, CDX registration began when a person 
received an EPA invitation letter that contained a temporary code and 
instructions on how to access the CDX registration website. CDX has 
adopted additional approaches to initiating registration for certain 
EPA programs, for example, embedding a link to CDX registration in 
reporting software that is distributed to the program's reporting 
community, or providing a public website where prospective CDX users 
can submit initial registration data EPA. While CDX continues to 
register persons by invitation letter for reporting under certain 
environmental programs, registration options will continue to broaden 
as the number of environmental programs supported by CDX expands.
    Finally, in the proposal, CDX registration was completed when the 
registrant printed out a ``signature holder'' agreement from the CDX 
registration website, signed this agreement and mailed it to EPA's CDX. 
CDX will continue this approach for reports where electronic signatures 
are required, although EPA is exploring the use of an entirely 
paperless signature agreement process for at least some of these cases. 
CDX registration to submit reports that do not include electronic 
signatures will not involve a ``signature holder'' agreement.
    EDI Standards. The proposal described EPA's plans to use EDI as the 
basis of standards-based formats for exchanging data between reporting 
entities and CDX. Since proposal, CDX development has reflected a 
significant evolution in formatting standards to accommodate the 
Internet--away from EDI and toward the use of XML. XML consists of a 
set of predefined tags and message structures that, like EDI, allows 
machine-to-machine exchange of data in a mutually agreed upon format, 
enabling exchange of data across different systems. However, unlike 
EDI, XML is tailored to Internet-based communications and security 
protocols. Additionally, an XML formatted file in combination with a 
style sheet can be displayed in a Web browser. Such features would 
allow CDX to use the same standard format both for exchanging data 
files and for designing web forms. The structure of XML also addresses 
some of the challenges in archiving data received, because the XML tags 
that accompany the data in an XML file can be used to interpret the 
data's context without the aid of additional software. This could 
facilitate the recovery of data from archived files, and reduces the 
need to maintain the versions of the software originally used to 
generate the files.
    CDX and specific EPA programs may address the question of which (if 
any) standards-based format to use for a particular report on a case-
by-case basis, and EPA intends to develop appropriate technical 
instructions for CDX submitters as program-specific reporting formats 
are adopted. These instructions normally will be distributed to the 
affected reporting communities via links on the CDX website and/or 
through program and CDX outreach efforts. EPA is working with 
authorized state, tribe, and local programs to develop standards-based 
reporting formats to meet their shared needs. In many instances, CDX 
contemplates a long transition period between file formats currently 
used to exchange data with regulated entities and any new, standards-
based formats. During this transition, CDX may offer submitters several 
electronic submission options; these may include an existing data 
format familiar to submitters, one or more new standards-based formats, 
and some other approach such as a smart-form hosted on a secure 
website.
    Client-side architecture and transaction environment. The proposal 
described a downloaded ``client'' that would generally supplement the 
browser to support the signature and security for CDX; such ``client 
side'' software is no longer needed for all cases of electronic 
reporting to CDX. However, in some cases CDX now uses various 
technologies to transparently insert routines into browsers during a 
user session to support special functions--for example to support the 
creation of a PKI-based electronic signature with an ACES business 
class certificate.

D. How will EPA provide notice of changes to CDX?

    As noted in the proposal, the fully-implemented CDX will be subject 
to change over time, to take advantage of opportunities offered by 
evolving technologies, as well as to improve the system. EPA's decision 
to avoid codifying technology-specific or detailed procedural 
provisions for electronic reporting is meant, in part, to accommodate 
changes to CDX without requiring that we amend our regulations. 
Nonetheless, EPA recognizes that such changes can affect regulated 
entities that participate in electronic reporting; therefore, the final 
rule provides for advance notice when EPA intends to make changes to 
CDX. As discussed in the proposal, we distinguish four categories of 
changes:
     ``Significant'' changes that are likely to affect the 
kinds of hardware, software or services involved in transmitting 
electronic reports (Sec.  3.20(a)(1));
     ``Other'' changes that will affect the process or the 
timing of transmitting electronic reports to CDX, but without affecting 
the kinds of hardware, software or services involved in making the 
transmissions (Sec.  3.20(a)(2));
     ``Emergency'' changes necessary to protect the security or 
operational integrity of CDX (Sec.  3.20(b)).
     ``De minimis or transparent'' changes that will have 
minimal or no impact on the process or the timing of transmitting 
electronic reports to CDX.

``Significant'' changes include changes to the types of file formats 
CDX will accept--for example a change from extended markup language 
(XML) formats to some non-XML format--as well as changes to the 
technologies that may be used for file transfer to CDX or for creating 
electronic signatures on transmitted reports. ``Significant'' changes 
will not generally include optional upgrades to software, the

[[Page 59864]]

provision of additional formatting (or other technical) options, or 
changes to CDX that simply reflect changes to the underlying regulatory 
reporting requirements. ``Other'' changes include an increase in--or 
re-ordering of--the steps involved in transmitting electronic reports, 
changes to the registration or credential (e.g., PIN, password, PKI 
certificate) provisioning process that could affect users ability to 
access CDX, and changes to reporting formats that involve the 
reconfiguration of software. ``Emergency'' changes include such things 
as an upgrade to the system firewall protection. Finally, ``de minimis 
or transparent'' changes include the myriad small or ``back end'' fixes 
and improvements that EPA makes to CDX each week that have minimal or 
no impact on the transmission process. Such changes may range from 
fixing a typo on a data entry screen to re-engineering the system's 
archiving routines.
    To address ``significant'' changes, Sec.  3.20(a)(1) of the final 
rule provides that EPA will give public notice in the Federal Register 
of such changes and will seek comment. EPA proposed to provide this 
notice at least a year in advance of contemplated implementation, but 
based on experience developing and operating a CDX prototype, EPA no 
longer believes that a single time-frame is appropriate in all 
situations. For example, ``significant'' changes that could affect the 
transmission of an annual report may respond to needs or events that 
arise less than a year in advance of the report's due date. On the 
other hand, some ``significant'' changes may require more than a year 
for reporting entities to accommodate. Accordingly, the final rule 
provides that these Federal Register notices will propose and seek 
public comment on an implementation schedule for a ``significant'' 
change, along with describing and inviting comment on the change 
itself. To address ``other'' changes to CDX, Sec.  3.20(a)(2) of the 
final rule provides that EPA will give notice at least 60 days in 
advance of implementation. The notice in this case will typically be to 
CDX users, and the method of notice may be electronic, perhaps using 
the facilities of CDX itself. For ``emergency'' and ``de minimis or 
transparent'' changes, EPA will make decisions on whether, when, and 
how to provide public notice on a case-by-case basis.

VI. Requirements for Electronic Reporting Under EPA-Authorized Programs

A. What is the general regulatory approach?

    As explained in Part V of this preamble, the requirements in Sec.  
3.10 of today's rule apply to reporting entities that submit electronic 
reports directly to EPA. By contrast, today's rule contains no 
requirements that apply directly to entities who submit electronic 
reports to state, tribe, or local government agencies. However, Subpart 
D of today's rule does contain requirements that apply to state, tribe, 
or local government agencies that operate EPA-authorized programs. 
Subpart D of today's rule requires that such agencies that receive, or 
wish to begin receiving, electronic reports under an authorized program 
must apply to EPA for a revision or modification of that program and 
get EPA approval. Subpart D provides standards for such approvals based 
on consideration of the electronic document receiving system that the 
state, tribe, or local government will use to implement the electronic 
reporting. Additionally, Subpart D provides for special procedures for 
program revisions and modifications that provide for electronic 
reporting, to be used at the option of the state, tribe, or local 
government in place of procedures available under existing program-
specific authorization regulations.
    Generally speaking, EPA believes that even absent today's rule, an 
authorized program's electronic reporting implementation would still 
need EPA's approval under a program revision or modification. At least 
where electronic reports may play a role in enforcement proceedings, 
the authorized program's electronic reporting implementation has the 
potential to affect program enforceability, and as such, revises or 
modifies the program. Today's rule makes this explicit in Sec.  3.1000. 
In addition, the final rule includes program-specific amendments to 
various provisions in 40 CFR to cross reference those rules to the new 
Part 3. With this approach, EPA hopes to support and promote state, 
tribe, and local government efforts to make electronic reporting 
available under their authorized programs, both by clarifying the 
requirement that EPA approve these electronic reporting initiatives, 
and by providing a single, uniform set of standards and a specially-
designed process to facilitate electronic reporting approval for 
otherwise authorized programs.

B. When must authorized state, tribe, or local government programs 
revise or modify their programs to allow electronic reporting?

    1. The general requirement. As discussed earlier, this rule does 
not require states, tribes, or local governments to allow or require 
electronic reporting. Where they choose to do so, Sec.  3.1000 
generally provides that they must revise or modify such programs to 
ensure that their electronic reporting implementation will meet the 
requirements of section 3.2000. Additionally, once these authorized 
programs begin operating the electronic reporting systems under EPA-
approved revisions or modifications, they must keep EPA informed of 
changes to laws, policies or the electronic reporting systems that 
could affect the program's compliance with Sec.  3.2000. Where the 
Administrator determines that such changes require EPA review and 
approval, EPA may ask the authorized program to submit an application 
for revision or modification to address the changes. Alternatively, the 
authorized program can apply for a revision or modification on its own 
initiative.
    For any of these program revisions or modifications, states, 
tribes, or local governments may use either the application procedures 
provided under Sec.  3.1000(b)-(e) or the program-specific procedures 
provided in other parts of Title 40 or the applicable statute. 
Whichever procedure is used, the state, tribe, or local government must 
submit an application that complies with the requirements of Sec.  
3.1000(b)(1), discussed in section VI.C.1. Section 3.1000(b)(1) 
identifies the elements of an electronic reporting program that EPA 
would need to consider in order to approve a state's, tribe's, or local 
government's approach to receiving electronic documents, in lieu of 
paper, to satisfy requirements under their EPA-authorized programs.
    2. Deferred compliance for existing systems. For authorized 
programs that have ``existing'' electronic document receiving systems 
as of the date this final rule is published, EPA is deferring the 
deadline for these programs to submit their applications for program 
revisions or modifications with respect to such systems. The deferral 
is generally two years from the date of this rule's publication. This 
approach is consistent with similar provisions under other regulations 
governing program authorization where new requirements are imposed. 
Additionally, EPA conducted extensive discussions with entities 
operating authorized programs about how much time they generally

[[Page 59865]]

would need to bring their systems into compliance with today's rule, 
given their funding cycles, program review schedules under 
``performance partnership'' agreements, the timeframes for making any 
necessary system upgrades and completing an application for program 
revision or modification, and any necessary legislative or regulatory 
changes. Based upon these discussions, we believe that this two-year 
period is generally sufficient to allow these programs to make the 
transition to CROMERR-compliant systems without having to discontinue 
their electronic reporting operations. Today's rule also allows 
authorized programs to request extensions to the two-year deadline 
where the timeframe for regulatory or legislative changes may be 
somewhat longer.
    EPA's purpose in deferring the application deadline for program 
revisions or modifications with respect to existing electronic 
reporting is to avoid disrupting authorized programs' electronic 
reporting initiatives that are already underway. With this goal in 
mind, EPA has defined ``existing electronic document receiving system'' 
broadly, to include not only those that are actually operational at the 
time the final rule is published, but also those that are substantially 
developed. We recognize that it would be disruptive to require that 
authorized programs shut down their operational systems during the time 
it would take to prepare, submit and have their applications for 
revision or modification approved. However, there is often a very fine 
line between an operational system and a system under development; for 
example, where the developmental work is to scale a working prototype 
up to production. In addition, at least the later stages of development 
are likely to be restrained substantially or even halted if a system 
must await EPA approval to operate, and this may affect system costs, 
availability of contractor staff and their ability to complete the 
system in a timely manner. Avoiding such disruptions to substantially 
developed systems is part of the goal of the deferred compliance 
provisions. To define what counts as a ``substantially developed'' 
system for this purpose, the definition of ``existing electronic 
document receiving system'' uses evidence that system services or 
specifications are already established by existing contracts or other 
binding agreements. Where an agency has already made legally binding 
agreements to procure a significant proportion of the services and/or 
components that will constitute the system then such a system would be 
considered ``existing'' under this rule.
    While many or most authorized programs with existing systems may 
need this two-year compliance deferral, some may have no difficulty 
submitting a completed application well before the end of two years. We 
strongly encourage such early submissions when feasible. This will make 
better use of EPA's review resources and will provide earlier certainty 
of compliance with this rule for existing state, tribe, and local 
government electronic reporting programs that are subject to this rule. 
In addition, EPA believes that, whether through informal consultation 
or formal application, identifying and addressing any existing system 
issues as early as possible is the best way to avoid disruption to 
electronic reporting initiatives currently underway.

C. What alternative procedures does EPA provide for revising or 
modifying authorized state, tribe, or local government programs for 
electronic reporting?

    Under Sec.  3.1000, this rule provides procedures which a state, 
tribe, or local government, at its option, can use to seek approval for 
revisions or modifications with respect to electronic reporting under 
its existing authorized programs. These optional procedures are 
available both for revisions or modifications that seek initial EPA 
approval for electronic reporting programs, and also for revisions or 
modifications to accommodate substantial changes to electronic 
reporting programs that already have EPA approval.
    Although there is always the alternative of using the program-
specific procedures provided in other parts of 40 CFR, EPA believes 
that, normally, a state, tribe, or local government would find the 
procedures provided in this rule to be shorter, simpler, and easier. 
The Sec.  3.1000 procedures allow submission of a single, relatively 
simple application to request revisions or modifications that address 
electronic reporting across any number of authorized programs. 
Additionally, the procedures provide for a single, straightforward EPA 
review process, with deadlines for EPA action written into the rule. 
EPA believes that these procedures will be especially useful where the 
state, tribe, or local government is planning to implement all of its 
program-specific electronic reporting with a single system. Rather than 
requiring approval program-by-program, Sec.  3.1000 allows the system 
to be addressed in a single application package that can be reviewed in 
its entirety and responded to within a relatively short and predictable 
time-frame.
    1. The application. To request modifications or revisions under 
this rule, Sec.  3.1000(b)(1) requires a state, tribe, or local 
government to submit an application that generally contains three 
elements. The first is a certification that state, tribe, or local 
government laws and/or regulations provide sufficient legal authority 
to implement electronic reporting in conformance with Sec.  3.2000 and 
to enforce the affected authorized programs using electronic documents 
collected under those programs; the application must also include 
copies of the relevant laws and/or regulations. This certification of 
legal authority is not meant to address actual conformance with Sec.  
3.2000(b); that is, the certification is not meant to reflect a 
judgment about the capabilities of an agency's electronic document 
receiving system. However, the certification would address Sec.  
3.2000(c), and must be signed by the governmental official who is 
legally competent to certify with respect to legal authority on behalf 
of his or her government. In the case of a state, this official must be 
the Attorney General or his or her designee. In the case of tribes or 
local governments, this official must be the chief executive or 
administrative official or officer or his or her designee. EPA realizes 
that obtaining an Attorney General's certification for state 
applications may involve considerable administrative burden; however, 
as a legal matter, EPA believes that Attorneys General or their 
designees are the only officials capable of certifying with respect to 
their states' legal authority. Where there are substantial 
administrative obstacles to involving the Attorney General in such 
certifications, EPA urges the state Attorney General to provide for a 
legally-competent designee who is available to participate in the 
submission of the state's application.
    The second element of the application, and the most substantive, is 
a listing and description of the electronic document receiving systems 
that do or will receive the electronic submissions addressed by the 
requested program revisions or modifications. The application should 
specify the electronic submissions each system will be used to receive, 
and which (if any) of these submissions involve electronic signatures. 
In describing each system, the application should explain how the 
system will satisfy the applicable requirements of Sec.  3.2000. Many 
of these requirements apply only to systems that receive submissions 
with electronic

[[Page 59866]]

signatures; accordingly, the descriptions for systems that receive no 
electronically signed submissions will be relatively short and simple. 
For each of the Sec.  3.2000 requirements that do apply, the 
description should explain the functions the system will perform to 
satisfy the requirement, and the technologies that will be used to 
achieve this functionality. EPA does not expect such explanations to 
include detailed technical specifications of the systems, but rather to 
provide conceptual descriptions of the technical approach and 
functionality. In implementing this rule, EPA will provide applicants 
with more detailed recommendations for preparing these system 
descriptions, including examples and an application checklist.
    The third element of the application is simply a schedule of 
upgrades to each system addressed by the application--to the extent 
that such upgrades can be anticipated--together with a brief discussion 
of how the upgrades will assure continued compliance with Sec.  3.2000. 
This third element should be thought of as an appendix to the second, 
recognizing that the functionality with which each electronic document 
receiving system addresses the Sec.  3.2000 requirements normally 
exists within the dynamic environment of the system life cycle.
    2. Review for completeness. Once EPA receives an application 
submitted under the procedures in this rule, EPA will, within 75 
calendar days, send a letter that either notifies the applicant that 
its application is complete or identifies deficiencies that render the 
application incomplete. An applicant that receives a notice of 
deficiencies may amend the application and resubmit it. From the date 
EPA receives the amended application, EPA will, within 30 calendar 
days, respond with a letter that either notifies the applicant that the 
amended application is complete or else identifies remaining 
deficiencies. If an amended application is not submitted within a 
reasonable time period to remedy identified deficiencies, EPA has the 
authority to review and act on the incomplete application, as explained 
in section VI.C.3.
    3. EPA actions on applications. EPA will act on an application by 
either approving or denying the requested program revisions or 
modifications. In the case of a consolidated application for revision 
or modification of more than one program, EPA need not take the same 
action on each revision or modification; some may be approved while 
others are denied. EPA will have 180 calendar days from the time it 
sends a notice of completeness to act on an application in its 
entirety. Except in certain cases of requested revisions or 
modifications associated with existing systems (see section VI.C.4) or 
with an authorized public water system program under 40 CFR part 142 
(see section VI.C.5), if EPA does not act on a program revision or 
modification by the end of the 180-day review period, then that 
revision and/or modification is considered automatically approved by 
EPA. The rule allows this review period to be extended, at the request 
of the state, tribe, or local government submitting the application. 
This may accommodate situations where EPA and the applicant are working 
through issues that may take more than the 180-day review period to 
resolve, and they mutually find it in their best interest to continue 
discussion before EPA makes its decision.
    Where EPA approves a program revision or modification (by either 
affirmative or automatic approval), the approval becomes effective when 
EPA publishes a notice of the approval in the Federal Register. Where 
EPA denies a requested revision or modification, EPA will explain the 
reasons for the action and advise the applicant of the steps that can 
be taken to remedy the application's defects and will generally try to 
work with the applicant to address the issues that have posed an 
obstacle to approval. Additionally, in some cases, denial of approval 
under the Sec.  3.1000 process may result from EPA's determination that 
the application raises certain issues that are highly program-specific 
and that these cannot be adequately addressed through the procedures 
provided in this rule. For example, there may be issues that require a 
discussion of program features that the Sec.  3.1000(b)(1) application 
would not cover. In such cases, EPA will identify the issues that 
exceed the scope of the Sec.  3.1000 process and will advise the 
applicant to request the revision or modification under the applicable 
program-specific procedures provided in other parts of Title 40.
    4. Revisions or modifications associated with existing systems. 
Some applications will request modification or revision to an 
authorized program with an ``existing electronic document receiving 
system''. As noted in section VI.B.2, the deadline for submitting such 
applications is two years after the publication of today's rule. Where 
such applications are submitted and are determined to be complete 
before the two-year deadline, EPA will have a 180-day review-period for 
any program modification or revision being requested, as explained in 
section VI.B.3. However, where EPA sends notification that an 
application is complete after the two-year deadline has passed, for 
example, because the application was submitted relatively late in the 
two-year period, EPA will have 360 days to act on any requested 
modification or revision addressed by the application. As with the 
cases where EPA has 180 days to act, this 360-day review period can be 
extended at the request of the state, tribe, or local government 
submitting the application.
    The rule provides for this extended review period to deal with the 
possibility that EPA will receive a large number of applications 
associated with existing systems just before the two-year deadline 
expires. If the number of such applications is sufficiently large, EPA 
may not be able to act on all of them within a 180-day review period. 
States, tribes, or local governments that wish to avoid the extended 
review may do so by submitting their applications addressing existing 
systems early enough in the two-year period to ensure that EPA can 
determine completeness before the deadline. As noted in section VI.B.2, 
EPA strongly encourages such early submissions wherever they are 
feasible.
    5. Public hearings for Part 142 revisions or modifications. Where a 
complete application requests a revision or modification of an 
authorized public water system program under 40 CFR part 142, EPA will 
make a preliminary determination on the request--either an approval or 
a denial--by the end of the 180-day review period (or the 360-day 
extended review period discussed in section VI.C.4). EPA will then 
publish a notice of the preliminary determination in the Federal 
Register. The notice will state the reasons for the preliminary 
determination, and will inform interested members of the public that 
they may request a public hearing on the preliminary determination. 
Such hearing requests must be submitted within 30 days of the notice's 
Federal Register publication. If no requests are submitted, and the 
Administrator does not hold a hearing on his or her own motion, then 
the preliminary determination will be effective 30 days after the 
initial Federal Register publication.
    If a request for hearing is granted, or the Administrator 
determines that a hearing is warranted, EPA will publish an additional 
Federal Register notice announcing--at least 15 days in advance of any 
such hearing--the date and time of any hearing, contact information, 
and the purpose of the hearing. At the hearing, a hearing officer will 
receive oral and written testimony, and will forward a record of the 
hearing to the EPA Administrator. After

[[Page 59867]]

reviewing the record of the hearing, EPA will by order either affirm or 
rescind the preliminary determination, and will publish notice of this 
decision in the Federal Register. If the order is to approve the 
revision or modification, the approval will be effective upon 
publication of the order in the Federal Register.
    6. Re-submissions and amendments. States, tribes, or local 
governments whose Sec.  3.1000 applications for revisions or 
modifications have been denied in whole or in part may reapply for 
reconsideration, using either the Sec.  3.1000 procedures again, or, at 
their option, the applicable program-specific procedures. A state, 
tribe, or local government may also, on occasion, choose to amend a 
Sec.  3.1000 application after the Administrator has determined the 
application to be complete. In such cases, the application will be 
considered to have been withdrawn and resubmitted as a new package, and 
a new 75-day completeness determination process will begin. An 
applicant may choose to withdraw and resubmit the package in this 
manner, for example, if it becomes clear relatively early into the 180-
day review period that the application cannot be approved in its 
current form. For such re-submissions, EPA will work diligently to 
expedite the completeness determination.

D. What general requirements must state, tribe, and local government 
electronic reporting programs satisfy?

    States, tribes, and local governments that accept electronic 
reports in lieu of paper under their authorized programs must satisfy 
the requirements of Sec.  3.2000(b) and (c). Section 3.2000(b) sets 
forth the standards that acceptable electronic document receiving 
systems must satisfy, and these are explained in detail in section 
VI.E. In parallel with Sec.  3.4 on federal compliance and enforcement, 
Sec.  3.2000(c) requires that the state, tribe, or local government be 
able to seek and obtain any appropriate civil, criminal or other 
remedies under state, tribe, or local law for failure to comply with a 
reporting requirement if a person submits an electronic document that 
fails to comply with the applicable provisions for electronic 
reporting. Similarly, Sec.  3.2000(c) contains provisions to ensure 
that an electronic signature provided to a state, tribe, or local 
government will make the person who signs the document responsible, 
bound, and/or obligated to the same extent as he or she would be 
signing the corresponding paper document.
    Additionally, under Sec.  3.2000(a)(2), the authorized program must 
require that any electronic document it accepts bear a valid electronic 
signature wherever the corresponding paper document would have to be 
signed under existing regulations or guidance, with the signatory being 
the same person who is authorized and/or required to sign under the 
current applicable provision. As in the case of direct reporting to EPA 
(see section V.A), the requirement for an electronic signature will 
apply only where the document would have to bear a signature were it to 
be submitted on paper, either because this is required by statute or 
regulation, or because a signature is required to complete the paper 
form. This rule does not require that authorized programs impose any 
new or additional signature requirements for electronic documents that 
are submitted in lieu of paper and were not previously required to be 
signed when submitted in paper form.
    As with direct reporting to EPA, Sec.  3.2000(a)(2) also allows an 
authorized program to make special provisions for the required 
signatures to be executed on follow-on paper submissions. As noted in 
section IV.C, such provisions must ensure that the paper submission 
containing the signatures is adequately cross-referenced with the 
electronic document being signed, and must be described as a part of 
the Sec.  3.1000(b)(1) application. Systems that receive electronic 
documents with such follow-on paper signature submissions are subject 
to all applicable Sec.  3.2000(b) requirements, including the 
requirement that the electronic document cannot be altered without 
detection after the signature has been executed.

E. What standards must state, tribe, and local government electronic 
document receiving systems satisfy?

    Section 3.2000(b) specifies the standards that electronic document 
receiving systems must satisfy if they are to be approved for use by 
states, tribes, or local governments to receive electronic documents in 
lieu of paper under an EPA-authorized program. EPA's purpose in 
specifying such standards remains the same as it was when EPA specified 
the proposed Sec.  3.2000 criteria in proposed CROMERR. As discussed in 
section IV.B.1, that purpose was to ensure that electronically 
submitted documents have the same ``legal dependability'' as their 
paper counterparts, so that any electronic document that may be used as 
evidence to prosecute an environmental crime or to enforce against a 
civil violation has no less evidentiary value than its paper 
equivalent. EPA has been motivated to provide for the legal 
dependability of electronic documents submitted under authorized 
programs by considering, among other things:
     The roles that many electronically submitted documents 
would likely play in environmental program management, including 
compliance monitoring and enforcement;
     EPA's statutory obligation to ensure that authorized or 
delegated programs maintain the enforceability of environmental law and 
regulations; and
     The consequent need to ensure that enforceability is not 
compromised as authorized programs make the transition from paper to 
electronic submission of compliance or enforcement-related documents.

The Sec.  3.2000(b) standards for electronic document receiving systems 
in today's rule provide an expanded version of what had been the 
proposed Sec.  3.2000(b) ``Validity of Data'' criterion. Like proposed 
Sec.  3.2000(b), final Sec.  3.2000(b) requires that electronic 
document receiving systems reliably enable EPA, states, tribes, and 
local governments to prove, in civil and criminal enforcement 
proceedings, that the electronic documents they receive and maintain 
are what they purport to be, that any changes to their content are 
documented, and that any associated signatures were actually executed 
by the designated signatories intending to certify that content. 
Systems must be able to satisfy the Sec.  3.2000(b) requirements for 
any electronic documents they receive that are submitted in lieu of 
paper to satisfy an authorized program requirement.
    The following discussion highlights some of the Sec.  3.2000(b) 
requirements for electronic document receiving systems. The first five 
of these requirements (timeliness of data generation, copy of record, 
integrity of the electronic document, submission knowingly, and 
opportunity to review and repudiate copy of record) apply to all 
electronic document receiving systems. The other highlighted 
requirements (validity of the electronic signature, binding the 
signature to the document, opportunity to review, understanding the act 
of signing, the electronic signature or subscriber agreement, 
acknowledgment of receipt, and determining the identity of an 
individual) apply only to systems that receive electronically signed 
documents.
    1. Timeliness of data generation. Section 3.2000(b) reflects the 
role that electronic document receiving systems play in supporting a 
wide range of compliance and enforcement-related activities, including 
compliance research and analysis, civil actions, and

[[Page 59868]]

litigation, and the fact that the success of such activities may be 
affected by the relative ease or difficulty of accessing the data 
related to electronic submissions. Accordingly, electronic document 
receiving systems must provide timely access to such data, especially 
to data relevant to the questions of what was submitted, by whom, and, 
where signatures are involved, who the signatories were and to what 
they certified. Much of this data may be assembled in the copy of 
record, together with any data needed to establish that the copy is a 
``true and correct copy of an electronic document received,'' as 
specified by the Sec.  3.3 copy of record definition. To help the 
litigator develop evidence and present it in the courtroom, it is 
advisable that the copy of record be maintained and made accessible in 
a form and format that requires the minimum possible ``assembly'' of 
its elements, so that its connection with what was received and what 
was certified to by any signatories is easy to understand and to 
demonstrate to others.
    2. Copy of record. Under Sec.  3.2000(b), an acceptable electronic 
document receiving system must retain and be able to make available a 
copy of record for each electronic document it receives that is 
submitted in lieu of paper to satisfy requirements under an authorized 
program. For such submissions, the copy of record is intended to serve 
as the electronic surrogate for what we refer to as the ``original'' of 
the document received where we are doing business on paper. The copy of 
record is meant to provide an authoritative answer to the question of 
what was actually submitted and, as applicable, what was signed and 
certified to in the particular case.
    As defined in Sec.  3.3, a copy of record must satisfy at least 
four requirements. First, it must be a true and correct copy of the 
electronic document that was received. In the case of documents 
consisting of data, this means that the copy of record must contain 
exactly the set of data elements that constituted the electronic 
document that was submitted. In the case of a document consisting of 
other forms of information, e.g., text or images, being a ``true and 
correct copy,'' may mean including file and or visual format 
information along with the items of information themselves, to the 
extent the meaning of these items is dependent on format. (See the 
discussion of the definition of ``electronic document,'' in section 
IV.D.1.) For the copy of record to fulfill its intended role, it is not 
enough that it be a true and correct copy; it must also be capable of 
being shown to be a true and correct copy; otherwise, it cannot meet 
other related system requirements, such as establishing document 
integrity. (See section VI.E.3, below.) The copy of record is shown to 
be true and correct in part by virtue of its not being repudiated by 
the submitters and/or signatories where it is made available for their 
review and repudiation. (See section VI.E.5., below.) In addition, the 
system must provide sufficient evidence to show how the copy of record 
was derived from and accurately reflects the electronic document as it 
was received by the system; such evidence is also necessary to 
establish document integrity. To provide for such evidence, the system 
may need to establish a chain of custody for the copy of record, 
particularly if there are a number of processing steps that separate 
the copy of record from the file as it enters the system. On the other 
hand, where the copy of record captures and preserves the file 
containing the electronic document exactly in the form and format in 
which it is received, then a chain of custody may not be necessary. 
Considerations of ``timeliness'' favor maintaining copies of record in 
a way that would not require a chain of custody. (See section VI.E.1., 
above.)
    Second, the copy of record must include all the electronic 
signatures that have been executed to sign the document or components 
of the document. The method of inclusion may vary, depending on the 
nature of the signature. With a digital signature, created by 
encrypting a hash of the document being signed with the private key in 
a private/public key-pair, the signature is simply a number that can 
and should be contained as a copy of record element. There is no risk 
of signature theft in this case. Each digital signature is bound to the 
specific document it signs, and the private key, which is actually used 
for signing, is inaccessible to a would-be intruder.
    With other forms of signature such as personal identification 
numbers (PINs) or passwords, items of personal information, or 
biometric images or values, including the signature as a copy of record 
element may raise signature theft issues. At least in theory, such 
signatures could be detached or copied from a copy of record and re-
used spuriously without detection. To address this risk, the signature, 
especially in the case of a PIN or password, may be encrypted for 
storage, perhaps together with a hash of the document signed, to bind 
the signature to the document content. Another approach may be to 
validate the signatory's identity, e.g. by comparing a signatory-
generated password with an encrypted version maintained securely at the 
electronic document receiving system. In such cases, the signatory-
generated password--which might be regarded as the signature--never 
actually appears on the electronic document, so the signature that is 
``included'' in the copy of record may be an encrypted form of the 
signature, or possibly nothing exactly corresponding to a signature at 
all, but rather pointers or references to the processes or encrypted 
data that provide the actual link to the signatory. There are analogous 
strategies for biometric signatures. For example, the validity of a 
biometric (e.g., a finger print, a retinal scan, etc.) may be 
established by using certain statistical algorithms to evaluate data 
provided by the biometric. In such cases, the copy of record might 
document the process of validating the signature, but without including 
the biometric data that was used to show that the signature was valid. 
On any of these approaches, the copy of record may satisfy the 
requirement that the copy ``include'' the signatures, provided that 
what the copy does contain serves to establish whether the electronic 
document in question was signed and by whom.
    Third, the copy of record must include the date and time of receipt 
to help establish its relation to submission deadlines, to the 
circumstances of its submission, and to other possibly associated 
documents that may have been submitted or alleged to have been 
submitted. This is not generally problematic, except in cases of 
continuous streams of data conveyed to the system. For such continuous 
data, reasonable alternatives may be substituted that serve the same 
purposes, for example, associating stages of the data flow with dates 
and times, say, at hourly intervals. Similarly, the copy of record may 
include other additional information to the extent that this is needed 
to establish the meaning of the content and the circumstances of 
receipt. Such additional information might include data field labels, 
signatory information such as references to PKI certificates, and 
transmission source information.
    Fourth, the copy of record must be viewable in a human-readable 
format that clearly indicates what the submitter and, where applicable, 
the signatory intended that each of the data elements or other 
information items in the document means. This supports the copy of 
record's role as a surrogate ``original'' of the paper document, and 
serves to establish the content of the document as it was signed and/or

[[Page 59869]]

submitted. The copy of record may satisfy this requirement in many 
different ways. It might actually include explicit labels or 
descriptions for each data element or information item, or preserve a 
visual format in which the data were submitted. Alternatively, it may 
incorporate a conventional ordering of the items or elements, where the 
information that associates such ordered data with labels, 
descriptions, or other means of visual display is maintained externally 
and can be invoked as needed--for example, to make the data elements 
appear within fields in the image of a filled-out form. Where the 
electronic document is created off-line by the submitter and conveyed 
as a whole to the receiving system, it is preferable for the copy of 
record to reflect the mechanism or format for indicating meaning 
supplied in the submission. For example, if the submission is in some 
standard electronic data interchange format, then the copy of record 
might usefully preserve that format. Taking this approach will help to 
resolve potential chain of custody issues if questions arise about 
whether the copy of record is true and correct. However, in cases where 
the electronic document is created on-line, for example, through the 
use of a web-form, the format for the copy of record will of necessity 
be an artifact of the electronic document receiving system itself. This 
is not problematic, as long as the system provides a way to ensure that 
the meaning of each data element as supplied by the submitter remains 
unambiguous.
    Some commenters objected to copy of record requirements because of 
the potential expense of redesigning systems that are not currently 
capable of creating and storing electronic copies of records. EPA 
notes, however, that systems satisfying copy of record requirements 
need not preserve the electronic documents received in separate or 
special storage apart from the files that maintain the data or 
information content of the documents. For example, data loaded from 
submitted electronic documents to a database may satisfy copy of record 
requirements where the stored content includes the signatures, the 
date/time of receipt, and an adequate chain of custody. This may be the 
most practical copy of record approach for receiving continuous data 
streams. Such an approach does not preclude satisfying the requirement 
that the copy of record be viewable in a human-readable format. The 
requirement does not mean that the data must be stored in a human-
readable format, so long as there is a well-documented way to display 
the stored data in such a format. In addition, nothing in the ``copy of 
record'' definition requires such copies to be electronic. Particularly 
where the signature involves some easily represented numerical value, 
the copy of record may be created and maintained in an imaging medium 
or on paper, provided that such copies can be shown to have been 
created by the electronic document receiving system to be true and 
correct copies of the electronic documents received. Whether such 
alternatives are appropriate as interim or even long-term solutions 
will depend on individual circumstances. It may be difficult to provide 
a copy of record for review and possible repudiation if the copy is not 
available as an electronic document that can be viewed on-line or 
downloaded through the network.
    3. Integrity of the electronic document. Under Sec.  3.2000(b)(1)--
(2), an acceptable electronic document receiving system must be able to 
establish that a given electronic document was not altered without 
detection in transmission or at any time after receipt, and any such 
alterations must be fully documented. For purposes of Sec.  
3.2000(b)(1)--(2), EPA excludes alterations that have no effect on the 
document's information content. Examples of excluded alterations 
include the separation of a transmitted file into packets and their 
error-free recombination, the error-free processes of file compression 
and extraction, as well as certain disk maintenance functions that may, 
for example, involve physically repositioning file components on the 
storage medium. To satisfy Sec.  3.2000(b)(1)--(2) requirements with 
respect to alterations that do affect information content, a system may 
rely on a number of different but complementary capabilities, including 
general provisions for system security, access control, and secure 
transmission. Additionally, the system's copy of record provisions help 
make the case that the electronic document is unaltered, or has been 
altered only as documented (for example, through a chain of custody), a 
case which is strengthened where submitters and/or signatories have had 
the opportunity to review the copy and have not contacted the system to 
repudiate the copy. Finally there are specific technical approaches to 
ensuring integrity, based, for example, on calculating hash values 
associated with the document content.
    4. Submission knowingly. Under Sec.  3.2000(b)(3), an acceptable 
electronic document receiving system must provide evidence that the 
submitter had some reliable way of knowing and/or confirming that the 
submission took place. This requirement is necessary to help establish 
submitter responsibility for the electronic document and to rule out 
spurious submissions, whether by accident or through the actions of an 
unauthorized submitter or ``hacker.'' EPA believes that to satisfy this 
requirement, the system must have some follow-on communication with the 
submitter related to the submission. This could be a communication 
initiated by the submitter in cases where it is realistic to rely on 
submitters to regularly check the system for evidence of documents 
submitted; where such submitter interactions are relied upon, they must 
be documented. Alternatively, the system must send some form of 
acknowledgment of submission as a response to the submitter named, and 
must document such acknowledgments, recording at least their date, 
time, content and the addresses to which they were sent. For cases 
where the electronic document bears an electronic signature, this 
acknowledgment is explicitly provided for under Sec.  3.2000(b)(5)(vi). 
(See section VI.E.11.)
    5. Opportunity to review and repudiate copy of record. Under Sec.  
3.2000(b)(4), the copy of record must be available for review and 
timely repudiation by the individuals to whom the document is 
attributed, as its submitters and/or signatories. The fact that the 
copy was available for this review and was not repudiated provides 
strong support for its being a ``true and correct copy of an electronic 
document received,'' as specified by the Sec.  3.3 copy of record 
definition. Program managers normally would set reasonable end dates 
for this process, especially where there is concern that the copy is 
not ``officially'' a copy of record until the process is complete.
    Satisfying this ``opportunity to review'' provision involves at 
least two requirements. The first is that the identified submitters 
and/or signatories must have some way of knowing that their submission 
was received, and that a copy of record is available for review. This 
requires some follow-on communication with the submitters and 
signatories related to the submission--initiated either by the 
submitters/signatories or by the system, as discussed in section 
VI.E.4. Approaches should be avoided that allow the initial submission 
and provision of copy of record to occur as a part of the same on-line 
session, because in cases of spurious submission the identified 
submitters/signatures may never learn

[[Page 59870]]

that a copy of record exists. Second, to ensure that the opportunity to 
review and repudiate is meaningful, the copy of record must be viewable 
in a human-readable format that clearly and accurately associates all 
the information elements of the electronic document with descriptions 
or labeling of those elements. This second requirement is consistent 
with the definition of ``copy of record,'' as discussed in section 
VI.E.2.
    6. Validity of the electronic signature. Under Sec.  
3.2000(b)(5)(i), for each electronic document that is required to bear 
an electronic signature, the receiving system must be able to establish 
that each electronic signature was a valid electronic signature at the 
time of signing. Under Sec.  3.3, as discussed in section IV.D.5, a 
valid electronic signature must satisfy three conditions. The first is 
that the signature must be created with a signature device that is 
``owned'' by the individual designated as signatory--``owned'' in the 
sense that this individual is uniquely entitled to use it for creating 
signatures. To establish this, an electronic document receiving system 
must be able to identify signature device ``owners'' and must be able 
to determine that an identified signatory is the owner of the device 
used to create the signature in question. Section 3.2000(b)(5)(vii) 
explicitly requires the ability to identify signature device owners, 
and section VI.E.12 of this Preamble discusses the Sec.  
3.2000(b)(5)(vii) requirements in detail.
    Concerning the determination that an identified signatory is the 
owner of the device used to create the signature, the system needs to 
have unique signature validation criteria for each identified signature 
device owner who submits electronically signed documents; the system 
must be able to apply these criteria to each signature on documents 
received. For example, in the case of a digital signature, the 
validation criteria include the existence of a valid PKI certificate 
for the identified signatory and the ability of the associated public 
key to decrypt the encrypted message digest that constitutes the 
signature. In the case of a PIN, the validation criterion may be simply 
that the PIN added to the document as a signature matches the PIN on 
file for the identified signatory.
    The second condition for an electronic signature to be considered 
valid is that the signature must be created with a device that has not 
been compromised. That is, at the time of signing, the electronic 
signature device must in fact be available only to the individual 
identified as its owner, and to no one else. Otherwise, the use of the 
device to create the electronic signature may not provide evidence that 
a specific, identifiable individual has certified to the truth or 
accuracy of an electronic document. Accordingly, an acceptable 
electronic document receiving system must provide evidence that the 
electronic documents it receives and maintains do not contain 
signatures executed with compromised devices. Such evidence will 
document the system's approach to three related functions: prevention 
of signature device compromise, detection of compromises where they 
occur, and rejection of known compromised submissions.
    The approach to prevention will include the way the system notifies 
submitters of their obligations to avoid signature compromise, 
including the obligation not to share or delegate the use of the device 
as a part of the electronic signature agreement. (See sections IV.D.4 
and VI.D.8. of this Preamble, respectively.) Prevention also involves 
choosing the kinds of signature devices to support and determining how 
they are to be used. Some devices are inherently vulnerable to 
compromise, for example, because protection from spurious use relies on 
``secret'' (such as a PIN or password) that has to be shared when the 
device is used. However, vulnerable devices can sometimes be 
strengthened with appropriate implementation. In the case of a PIN or 
password, adding an element that does not rely on secrecy--e.g. a 
physical ``token,'' such as a smart card or employee badge--that had to 
be used along with the PIN or password may greatly reduce the device's 
vulnerability. Alternatively, a system accepting secret-based 
signatures might be programmed to query the would-be signatory about a 
randomly selected piece of private information that has been (or could 
be) verified. This approach would also reduce vulnerability to 
compromise, since the discovery of a secret number or password does not 
convey other private information about the secret's owner.
    For detection of compromises, there are two complementary 
approaches. The first is to ensure that the system recognizes the signs 
of spurious submission, for example, duplicate reports, off-schedule 
submissions, and deviations from normal content or procedure. The 
second is to ensure that the system empowers submitters to detect and 
report spurious submissions by providing the regular ``out of band'' 
acknowledgments discussed in section VI.E.11. Once spurious submissions 
are detected, the system must ensure their rejection, and the rejection 
of any subsequent submissions that use the same device. An acceptable 
receiving system must provide for timely revocation or suspension of 
access by those individuals with compromised signature devices.
    Finally, a signature must be created by an individual who is 
authorized to do so, primarily by virtue of his or her relationship 
with the regulated entity on whose behalf the signature is executed. An 
electronic document receiving systems must be able to determine whether 
the identified signatories have the necessary relationship with the 
regulated entity that enables them to sign the documents being 
submitted. Generally, the system would obtain the information necessary 
for these determinations along with establishing the identity of the 
signature device owners. Section VI.E.12 of this Preamble discusses 
this point in more detail.
    The system must also have some way to keep this information up-to-
date, for example, some way to reject signatures where it is known that 
the signature device owner is no longer authorized to sign the 
electronic document in question. As with the initial registration 
process, the provisions for updating this information may vary. For 
some cases, it may be sufficient to rely on voluntary notifications 
from registrants when, e.g., their job status changes. For other cases, 
it may be appropriate to identify a responsible company official who is 
charged with managing the authorizations of employees signing documents 
on behalf of the company, to include keeping records of changes in 
authorization status and/or sending notifications. For certain cases, 
the system might limit a signature device owner's authorization to a 
defined period, which could be extended only through a re-registration 
process.
    7. Binding the signature to the document. Under Sec.  
3.2000(b)(5)(ii), an acceptable electronic document receiving system 
must establish that electronic documents cannot be altered without 
detection once such documents are signed. Well-implemented provisions 
for copy of record help satisfy this requirement. The fact that a 
signatory has not repudiated a document's copy of record that he or she 
has had the opportunity to review provides evidence that the copy 
accurately reflects the document as it was signed. However, even where 
the signatory affirms the authenticity of the copy of record at the 
time of review, he or she may still repudiate the document at a later 
date. Therefore, an acceptable electronic document receiving system

[[Page 59871]]

must provide a method of ensuring that any breach of a signed 
document's integrity can be detected. As discussed in section IV.B.2., 
such methods are available in the form of signatures that incorporate a 
hash value of the content being signed, or in the form of signature 
processes that involve the creation of this hash and its maintenance in 
association with the signed document. Encrypting the hash value, for 
example, by executing a digital signature, provide the strongest 
approach to rebutting claims that the hash has been manipulated. 
Encryption may not be necessary to the extent that the system provides 
other means to prevent tampering and establish that the hash has not 
been altered since it was calculated.
    8. Opportunity to review. Where a signatory is certifying to the 
truth or accuracy of document content, the certification represents the 
signatory as knowing and understanding the content, as well as 
certifying to its truth. Under Sec.  3.2000(b)(5)(iii), an acceptable 
electronic document receiving system must be able to provide evidence 
that the signatory had the opportunity to review what he or she was 
signing in a human-readable format. Providing this evidence may be 
relatively simple, depending on the signature/certification scenarios 
that the system provides for or allows. In a case where the system only 
allows signature/certification during an on-line client-server session, 
and where the server always explicitly gives the signatory the option 
of scrolling through an appropriately-formatted display of the 
submission content before signing, documenting these server functions 
should suffice to provide the required evidence. Cases that may be 
similarly straightforward include those where signature/certification 
takes place off-line, at the signatory's computer, but using software 
provided by or certified by the governmental entity whose system will 
receive the signed electronic document. In this case, the evidence is 
provided by documenting how the software works. Less straightforward 
are cases where the signature/certification software is completely 
beyond the control of the governmental entity. In such cases, evidence 
of the opportunity to review may need to rely on the use of a 
submission format that demonstrably allows a human-readable display of 
the content. For example, the fact that the file format is a Word or 
Excel file and that the file provides a human readable display when 
opened with the right program may constitute sufficient evidence that 
the opportunity to review has been provided.
    9. Understanding the act of signing. Where a signatory is 
certifying to the truth or accuracy of document content, the 
certification affirmatively represents that the signatory understands 
both what the act of signing means and that he or she is subject to 
criminal liability for false certification. Reporting formats in the 
paper medium provide evidence that certifications are made with the 
requisite understandings by placing the certification statement in a 
clearly visible position near the place where signatures are to be 
affixed and by prominently displaying the statement that there are 
criminal penalties for false certification. Under Sec.  
3.2000(b)(5)(iv), an acceptable electronic document receiving system 
must ensure that such statements are presented in conjunction with 
electronic signature/certification. Satisfying this requirement is 
straightforward where the system itself provides for the signature 
process or where the governmental entity receiving the submission 
provides or otherwise has control over the signature/certification 
software being used. In other cases, satisfaction will depend on 
requiring that the signatories and/or submitters incorporate such 
statements into their documents before they are signed or into screens 
that are displayed prior to signature. Confidence that the requirement 
is satisfied will depend in part on the extent to which the submission 
process involves the use of common, easy-to-display file structures 
together with the software to display the files being signed.
    10. The electronic signature or subscriber agreement. Under Sec.  
3.2000(b)(5)(v), an acceptable electronic document receiving system 
must be able to provide evidence that any signatory of documents 
received by the system has signed an electronic signature agreement or 
subscriber agreement with respect to the electronic signature device he 
or she uses to sign the documents. ``Electronic signature agreement'' 
and ``subscriber agreement'' are defined under Sec.  3.3, the latter 
referring to electronic signature agreements that are executed with ink 
on paper. (The distinct role of subscriber agreements is explained in 
section VI.E.12.) By signing such agreements, an individual agrees to 
protect his or her signature device from compromise, that is, to keep a 
secret code secret, a hardware token secured, etc., and not to 
deliberately compromise the device by making it available to others. He 
or she also agrees to promptly report any evidence that the device has 
been compromised, for example, to promptly notify the system manager if 
he or she receives system acknowledgments of submissions he or she did 
not make, or if the device has become available to others. Finally, by 
signing the electronic signature or subscribed agreement, an individual 
agrees that use of his or her electronic signature device to sign 
documents creates obligations and/or legally binds him or her to the 
same extent as he or she would be bound or obligated by executing 
handwritten signatures. EPA believes that such agreements are necessary 
to assure--and provide evidence--that the signatory recognizes his or 
her obligations with respect to the electronic signature device. 
Insofar as the institutions surrounding the use of electronic 
signatures are relatively new, EPA believes that express recognition of 
signatory obligations through explicit agreements avoids potential 
ambiguity or misunderstandings.
    11. Acknowledgment of receipt. Where an electronic signature is 
used to certify to the truth or accuracy of document content--with 
criminal liability for false certification--then it is especially 
important to ensure that any individual identified as signatory has the 
opportunity to detect and repudiate any spurious submissions made in 
his or her name through unauthorized access to signature device and/or 
the electronic document receiving system. To provide for this, Sec.  
3.2000(b)(5)(vi) requires the system to automatically send 
acknowledgments of document receipt to the individuals in whose names 
the submissions are made, the acknowledgments in each case identifying 
the document in question, the signatories, and the date and time of 
receipt.
    Additionally, Sec.  3.2000(b)(5)(vi) requires that each 
acknowledgment be sent to an address with access controls different and 
separate from those that enable the submission itself, so that in cases 
of compromised access, the individual in whose name a submission is 
made would still receive the acknowledgment without interference. This 
is sometimes referred to as ``out of band'' acknowledgment. In web-
based commerce, this is fairly standard practice--a purchase is 
normally acknowledged directly to the internet protocol (IP) address 
from which the purchase is made, as a part of the on-line session, but 
also is confirmed through a follow-up communication to an email 
address. Note that while the ``out of band'' acknowledgment is normally 
sent electronically, electronic transmission is not required. A paper 
acknowledgment sent by U.S. Mail, or a voice acknowledgment via 
telephone would serve the same purpose so long

[[Page 59872]]

as these are documented by the system so they may be produced, possibly 
as evidence, at a later date.
    12. Determining the identity of the individual uniquely entitled to 
use a signature device. As discussed in section VI.E.6, a system cannot 
accept an electronic signature as valid unless it establishes an 
identity between the individual designated as signatory and the owner 
of the device used to create the signature. Any circumstance casting 
doubt on the device's ownership undermines the certainty that 
signatures created with the device are valid; if it's not certain whose 
device created the signature then it's not certain whether the actual 
signatory is the individual who is designated as signatory in the 
submitted document. Additionally, it must be clear what the signature 
device owner's relation is to the entity on whose behalf a document is 
signed, in order to be certain that this device owner is an authorized 
signatory. This is also a condition of signature validity. (See section 
VI.E.6.) Accordingly, to assure that electronically signed documents 
are legally reliable, a system accepting such documents must have a 
process for determining who owns the signature devices used to create 
the signatures, and their relations to the entities on whose behalf 
they sign submitted documents. Section 3.2000(b)(5)(vii) explicitly 
reflects this performance standard by requiring that a system provide 
for such determinations ``with legal certainty.'' That is, the system 
must be able to provide evidence sufficient to prove the signature 
device owner's identity and relation to entities on whose behalf he or 
she signs in a context where designated signatories may have an 
interest in repudiating their signature device ownership or in 
distancing themselves from the entities on whose behalf they are 
supposed to have signed.
    Section 3.2000(b)(5)(vii) does not specify how this performance 
standard is to be met, however, at a minimum, an ``identity-proofing'' 
capability must involve access to a set of descriptions that apply 
uniquely to the individual in question and refer to attributes that are 
durable, documented, and objective. Such descriptions must be capable 
of being shown at any time to uniquely identify the individual without 
having to depend on anyone who might have an interest in repudiating 
the identification. Section 3.2000(b)(5)(vii) requires that more 
specific conditions be met for the special class of electronically 
signed documents that are included in the list that defines ``priority 
report'' under Sec.  3.3 and Appendix 1 to Part 3. The priority reports 
are those that EPA has identified as likely to be material to potential 
enforcement litigation. Given this likelihood, it is important to 
provide not only for the provability of signature device ownership in 
principle, but for the practical need to make this proof with the 
resources typically available to enforcement staff and within the 
constraints of the judicial process in criminal and civil proceedings. 
To address this practical dimension of identity-proofing in the case of 
priority reports, Sec.  3.2000(b)(5)(vii) adds three conditions to the 
general performance standard. The first is that the identity of a 
signature device owner must be verified before the system accepts any 
electronic signature created with the device. The second, in Sec.  
3.2000(b)(5)(vii)(A), is that this verification must be ``by 
attestation of disinterested individuals.'' The third condition, also 
contained in Sec.  3.2000(b)(5)(vii)(A), specifies that the 
verification be ``based on information or objects of independent 
origin, at least one item of which is not subject to change without 
government action or authorization.''
    Regarding the first condition, requiring identity-proofing before 
the signature device is used helps prevent systems from accepting 
electronic signatures that cannot be proved to be valid in the context 
of an enforcement proceeding. This is at least a potential concern in 
any case of electronic signature, but it is also a very real concern in 
cases where what is signed is a priority report. The second condition 
anticipates the need to prove signature device ownership in court, by 
ensuring the availability of someone credible to offer testimony about 
the device owner's identity who does not have an interest in 
repudiating device ownership. This is the idea of verification by a 
``disinterested individual,'' the term defined under Sec.  3.3 as ``a 
person who is not the employer; the employer's corporate parent, 
subsidiary, or affiliate; contracting agent; or relative (including 
spouse or domestic partner) of the individual in whose name the 
electronic signature device is issued.'' The condition suggests an 
identity-proofing process carried out by a trusted third party, and, in 
the current electronic commerce environment, this would typically be a 
PKI certificate authority (CA), whose business is to issue certificate-
based electronic signature devices that reflect identity-proofing at a 
specified level of assurance. However, it is important to be clear that 
verification by a ``disinterested individual'' does not have to involve 
a PKI-based approach to electronic signatures. Indeed, it does not have 
to involve a third party at all; the disinterested individual could 
simply be an employee of the agency operating the electronic document 
receiving system, if that agency itself has the resources to provide 
for identity-proofing as it registers signature device owners to use 
the system. Additionally, if a trusted third party is wanted, there are 
alternatives to the CA. For example, with an appropriately defined 
procedure, a notary public or some local government official could play 
this role; so could some other governmental agency, such as department 
of motor vehicles, which is in the business of issuing credentials 
based (usually) on in-person verification of identity.
    The third condition sets a standard for the evidence on which 
verification of identity would be based--evidence that would be 
attested to by the disinterested individual provided for by the second 
condition. The standard refers to ``information or objects'' and for 
each requires that they be ``of independent origin'' and include at 
least one item that requires ``governmental action or authorization'' 
to change. Information ``of independent origin'' must be knowable 
empirically, and not simply as a matter of someone's say so; objects of 
independent origin could provide such information. Such information, 
where it concerns an individual's identity, would generally come from 
three sources: first, documented, direct, in-person contact; second, 
documentation of the individual's history--e.g., as an employee, a 
consumer, a student, etc.--with objects such as credit cards, 
passports, etc., sometimes together with corroborating testimony; and 
third, forensic evidence of unique, immutable traits, from such objects 
as fingerprints, photos, and handwritten signatures.
    Evidence of identity from any of these three sources will meet the 
Sec.  3.2000(b)(5)(vii)(A) standard, provided that the information used 
also includes at least one item that cannot be changed without 
governmental action or authorization--for example, a social security 
number, a passport number, or a driver's license number. This last 
requirement helps assure that the identifying information used is 
sufficiently well-documented and durable to support re-verification of 
identity at some later date. The requirement also facilitates identity-
proofing that relies on database searches, insofar as data on 
individuals tends to be keyed to government-issued identifiers. 
Finally, while such

[[Page 59873]]

identifiers are items of information, they typically are presented on 
objects--e.g. a driver's license or a passport--that provide 
independent evidence of their authenticity.
    EPA recognizes that the identity-proofing requirements specified in 
Sec.  3.2000(b)(5)(vii)(A) may be difficult to implement in some cases. 
The rule therefore allows a system to meet the Sec.  
3.2000(b)(5)(vii)(A) requirements for cases of priority reports in 
other ways. Under Sec.  3.2000(b)(5)(vii)(C), a system may collect a 
subscriber agreement (see section VI.E.10) from each signatory of the 
priority reports received by the system, in lieu of satisfying Sec.  
3.2000(b)(5)(vii)(A). Alternatively, the system may collect a 
certification from a ``local registration authority'' (LRA) that such a 
subscriber agreement has been executed and is being securely stored. As 
defined under Sec.  3.3, an LRA is an individual who plays the role of 
a custodian of subscriber agreements, maintaining these paper 
agreements as records and sending the system a certification of receipt 
and secure storage for each such agreement he or she receives. The 
presumption is that such certifications would be sent electronically to 
the system as signed electronic documents. To become an LRA, an 
individual must have his or her identity established by notarized 
affidavit, and must be authorized in writing by the regulated entity to 
issue these ``agreement collection certifications'' (defined under 
Sec.  3.3) on its behalf.
    A state, tribe, or local government adopting the subscriber 
agreement alternative might chose to implement through LRAs as a way of 
reducing the pieces of paper it had to manage in operating its 
electronic document receiving system. While setting up the LRA 
relationships requires the collection of affidavits and authorizations 
on paper, this involves far fewer paper transactions than collecting 
the individual subscriber agreements from each person who signs 
priority reports. However, only larger companies or facilities with 
many employees signing priority reports are likely to be motivated and 
able to designate a company official as an LRA. Although nothing in the 
rule prohibits third parties from serving as LRAs for the smaller 
companies, a subscriber agreement implementation will probably always 
involve accepting some of these agreements directly from priority 
report signatories. What is essential under Sec.  3.2000(b)(5)(vii)(C) 
is that a subscriber agreement be available, as needed, to establish 
the identity of the associated signature device owner. Identity in this 
case is established based on the forensic properties of the handwritten 
signature on the agreement.
    Finally, Sec.  3.2000(b)(5)(vii)(B) gives states, tribes, or local 
governments the flexibility to propose identity-proofing methods that 
may not meet the specific requirements of Sec.  3.2000(b)(5)(vii)(A), 
but which are no less stringent than the methods that satisfy Sec.  
3.2000(b)(5)(vii)(A). For example, if a method of electronic identity-
proofing were proposed that relies on the attestations of an LRA who is 
not a disinterested party, EPA would look for other features in the 
identity-proofing method that guarantee the identity of the LRA and the 
trustworthiness of the identity-proofing that the LRA would conduct. 
Similarly, if an identity-proofing method were proposed that relies on 
objects or information that are not of independent origin (e.g., a 
company identification card), EPA would look for other features in the 
authentication method that guarantee that the registrant's identity 
could not have been manufactured by the registrant or another 
interested party. EPA's expectation is that the advance of technology 
may also make new methods of identity-proofing available that meet the 
needs of the enforcement community, and we expect that Sec.  
3.2000(b)(5)(vii)(B) could be used to accommodate such new methods when 
implemented as part of electronic document receiving systems.

VII. What are the costs of today's rule?

A. Summary of Proposal Analysis

    The Agency has conducted a number of analyses to ensure that this 
rule complies with the various statutory and administrative 
requirements that apply to EPA regulations. The results of the analyses 
are summarized in this section.
    In the proposal, EPA estimated that the proposed rule could result 
in an average annual reduction in burden of $52.3 million per year for 
those facilities reporting, $1.2 million per year for EPA, and $1.24 
million for each of the 30 states that were assumed to implement 
programs over the eight years of the analysis. EPA received many 
comments on the costs associated with the proposed electronic reporting 
provisions. Comments included concerns about the proposal's assumptions 
related to the number of affected entities, the number of registered 
users per facility, the costs to state programs, and the costs of 
implementing standard formats. Several commenters expressed support for 
the analysis findings, concurring that electronic reporting will reduce 
their environmental reporting costs. EPA's response to these comments 
is explained in the following section. Additional comments on the cost 
analysis and EPA's responses can be found in the rulemaking docket, in 
the Response to Comments document.

B. Final Rule Costs

    In response to comments received on the proposed rule, EPA 
conducted additional cost analyses to determine the impacts of this 
rule on regulated entities, states, tribes, and local governments, and 
EPA programs. In developing the analysis for this final rule, EPA 
relied heavily on existing sources of data that included:
     EPA's 2002 Government Paperwork Elimination Act (GPEA) 
Report to OMB;
     Interviews with EPA programs, states, and nine industry 
representatives currently using CDX to report electronically;
     EPA's Information Collection Requests (ICRs);
     EPA's Envirofacts Warehouse and Facility Registry System;
     Follow-up to comments received from twenty state and local 
government agencies and several major industry associations; and
     Market research to assess trends of large and small 
companies using the Internet, costs of technology for electronic 
signature and data exchange formats, and other technical issues.
    Based on the additional analyses, EPA estimates that under this 
rule there will be a total cumulative cost savings to the Agency, over 
the period 2003 to 2012, ranging from $64.4 million to $75.4 million, 
depending on the discount rate used. For those that adopt electronic 
reporting, EPA estimates a total cumulative cost burden to state and 
local governments under this rule, over the period 2003 to 2012, 
ranging from $57.2 million to $65.2 million annually, depending on the 
discount rate used. These costs result from the incremental burden to 
states to upgrade their receiving systems to meet the rule's standards 
and apply for EPA approval of program modifications and revisions. The 
model does not consider the potential cost savings to state and local 
governments resulting from processing electronic submittals but 
believes the savings would likely offset these incremental costs. For 
facilities, EPA estimates a total cumulative cost during this period 
ranging from $41.6 million to $51.9 million, depending on the discount 
rate used. The net total cumulative cost of this rule, over the period 
2003 to 2012, ranges from $34.4 million to $41.7 million, depending on 
the discount rate used.

[[Page 59874]]

C. General changes to methodology and assumptions

    The research effort for the final rule differed from that conducted 
for the proposal in that it was much broader and involved far greater 
engagement with external stakeholders. EPA used this research to 
reevaluate assumptions made in the proposal and to refine the overall 
approach to the cost-benefit analysis. The process of reevaluating 
costs to regulated entities included:
     Analyzing the GPEA report to determine the specific 
information collections identified as being suitable for electronic 
reporting and their implementation schedule;
     Evaluating each information collection request for an 
understanding of the types of activities that would be eliminated (such 
as mailing paper forms) or reduced (manual data quality checks) through 
electronic reporting;
     Interviewing trade associations, reviewing comments 
received, evaluating market trend research, and querying Envirofacts 
warehouse and Facility Registry System to establish an understanding of 
the numbers of potential facility representatives that would register 
for a particular program, the rate of electronic reporting growth in a 
program, the number of facilities using web forms or file exchanges, 
and the relative distribution of small to large businesses; and
     Establishing an understanding of the time required by 
facilities to register with CDX and maintain a CDX account, through 
interviews with CDX registered users and the CDX hotline.
    The process of reevaluating costs and benefits to EPA, state, 
tribes, and local governments, included:
     Meeting with EPA programs and state program counterparts 
to identify the broad range of EPA authorized programs and the types 
and number of agencies under each program;
     Interviewing state and local agencies and their 
associations as follow-up to public comment to obtain an understanding 
of their current electronic reporting systems, long-term plans, and 
perceived impacts to their systems from this rule;
     Evaluating current information technology expenditures of 
CDX and other program system development efforts, and general costs of 
EPA rulemakings with respect to federal costs and benefits.
    In preparing the CBA, EPA used a computer model to estimate the 
annual costs to EPA, state and local governments and regulated 
entities. To evaluate the costs and benefits of this rule, two 
scenarios were modeled: a ``Baseline'' scenario in which EPA would 
enable electronic reporting through an approach other than CROMERR and 
a ``To Be'' scenario in which EPA enables electronic reporting under 
CROMERR. In comparing the cumulative costs of this rule, EPA notes that 
the ``To Be'' scenario would be a more efficient approach than the 
``Baseline'' scenario. Under the ``Baseline'' scenario, EPA programs 
would be left to implement their own program-specific electronic 
reporting requirements and electronic document receiving systems. Also, 
under the ``Baseline'' scenario, electronic reporting would be delayed, 
because EPA would have to generate separate rules and guidance to 
support program-specific electronic document receiving systems. Once 
these systems were established, reporting entities could conceivably be 
required to register under different rules and through different 
systems across EPA programs.
    Based on the new research, EPA revised assumptions about the costs 
associated with authorized programs and corresponding benefits to the 
reporting entities. In contrast to the proposal, EPA does not claim the 
costs associated in building electronic document receiving systems for 
authorized programs (state, tribe, and local) or the benefits for their 
reporting entities in using these systems. Since it is clear that 
authorized programs intend to proceed with electronic reporting on 
their own regardless of this rule, the analyses for the final rule 
looks at the incremental costs to electronic document receiving systems 
that would be developed absent this rule, in meeting the final rule's 
requirements.
    Based on research and comments received on the proposal, EPA also 
revised the following key cost assumptions:
     Increased costs for XML. EPA substantially increased the 
cost estimate of integrating an XML format into a facility's 
environmental management system (from $4,000 to $10,000).
     Increased number of registered users. EPA substantially 
increased the number of registrants (from 3 registrant/facility to 6 
registrants per facility) in large companies that would use CDX.
     Broadened impacts of authorized programs. EPA 
substantially broadened the number of state, tribe, and local 
environmental agencies potentially impacted by the rule, to include 
health departments, county air boards, oil and gas agencies, and 
publicly-owned treatment works.

VIII. Statutory and Executive Order Reviews

A. Executive Order 12866

    Pursuant to the terms of Executive Order 12866 (58 FR 51735, 
October 4, 1993), it has been determined that this rule is a 
``significant regulatory action'' because it raises novel legal or 
policy issues. As such, this action was submitted to OMB for review. 
Changes made in response to OMB suggestions or recommendations are 
documented in the public record.
    For EPA, the average annual cost to implement and operate 
electronic reporting under this rule is estimated to be $60.94 million. 
The average annual cost to implement and operate electronic reporting 
in the absence of this rule (i.e., where EPA implements electronic 
reporting on a program-specific basis) is estimated to be $70.36 
million for EPA. The average annual cost savings to EPA under this rule 
is $8.42 million. The average annual cost to states, tribes, and local 
governments in initially upgrading their electronic receiving systems 
and obtaining EPA approval for appropriate program modification under 
the rule ranges from roughly $5,000 to $460,000, depending on the 
number of systems and extent of the upgrades needed. In addition, 
states, tribes, and local governments that upgrade their systems are 
expected to incur system maintenance costs averaging about $10,000 
annually. These costs reflect solely the incremental costs resulting 
from the rule; they do not reflect the cost savings that states, 
tribes, and local governments will experience in implementing their 
receiving systems. EPA has not quantified these savings as part of its 
analysis. It should be noted that EPA expects today's rule to produce a 
net cost savings for states, tribes, and local governments. However, it 
is not possible to provide an adequate year-by-year comparison of the 
costs of the two scenarios, because the Baseline Scenario anticipates a 
more gradual process of EPA approval for state, tribe, and local 
government electronic reporting systems, starting at a later point in 
time.
    The average annual cost to facilities to submit electronic reports 
to EPA in compliance with today's rule ranges from $9 for those 
entities that choose simply to use a web browser to access CDX and fill 
out web forms, to $10,000 per facility for those companies that wish to 
configure their environmental management systems to exchange data with 
CDX, using agreed-upon data exchange formats.
    In addition to the monetary benefits identified by the analysis, 
EPA also

[[Page 59875]]

believes that there are many qualitative benefits that justify the 
initial costs associated with the rule. These benefits include:
     Responding to federal requirements, such as GPEA, which, 
among other things, requires federal agencies to allow individuals or 
entities that deal with the agencies the option to submit information 
or transact with the agency electronically. This rule sets the legal 
framework for most major EPA initiatives implementing electronic 
environmental data exchanges with the various stakeholders.
     Maintaining consistency with emerging industry commercial 
practices. The implementation of electronic government initiatives is a 
reflection of the rapid evolution of electronic commerce, which has 
occurred in industry since the expansion of the Internet and the World 
Wide Web (WWW), in the early 1990s. In many ways, EPA and state, tribe, 
and local environmental agencies' implementations of electronic 
reporting under today's rule will be more consistent with emerging 
practices and less burdensome to industry than paper reporting.
     Providing sound environmental practice. Part of EPA's 
mission is conserving environmental resources. The traditional paper-
based reporting practices and processes consumes trees and other 
resources for printing, exchanging, reproducing, storing, and 
retrieving grants, permits, compliance reports, and supporting 
documents.
     Fostering more rapid environmental compliance reporting. 
Organizations have become increasingly environmentally conscientious. 
This change stems both from a desire to be good corporate citizens and 
from fear of negative media reporting. Hence, organizations, especially 
large companies, are becoming increasingly interested in being able to 
demonstrate their environmental compliance. More rapid and accurate 
public posting of compliance data by environmental agencies is one way 
to help achieve this goal.
     Simplifying facility reporting. Electronic reporting and 
EPA's planned implementation support a single point of entry into 
agency systems, which will enhance facilities' ability to locate 
appropriate regulations, obtain information, ask questions, obtain 
forms, and submit data.
     Providing more accurate data. Replacing paper forms with 
electronic forms will result in more accurate data. Systems 
incorporating electronic forms can perform real time edit checks that 
will reduce the number of input errors. These checks can range from 
simple verification of valid date formats, to complex validations of 
proper nomenclature and limits of chemicals emitted into the 
environment. Improved data quality will also help reduce the time 
required for data correction and the effects of inaccurate reporting.
     Making data more readily available. The process of 
creating, mailing, receiving, entering, verifying, and correcting paper 
reports consumes both resources and time. This delays the analysis of 
the data by EPA and authorized programs and its availability to 
decision makers and the public.
     Provides the foundation for further process re-
engineering. Moving data from a paper to an electronic system as early 
in the process as possible creates the foundation on which many work-
flow re-engineering initiatives can be constructed.

B. Executive Order 13132

    Executive Order 13132, entitled ``Federalism'' (64 FR 43255, August 
10, 1999), requires EPA to develop an accountable process to ensure 
``meaningful and timely input by state and local officials in the 
development of regulatory policies that have federalism implications.'' 
``Policies that have federalism implications'' are defined in the 
Executive Order to include regulations that have ``substantial direct 
effects on the states, on the relationship between the national 
government and the states, or on the distribution of power and 
responsibilities among the various levels of government.''
    This final rule does not have federalism implications. EPA has 
determined that the final rule will not have substantial direct effects 
on the states, on the relationship between the national government and 
the states, or on the distribution of power and responsibilities among 
the various levels of government, as specified in Executive Order 
13132. The final rule will not require states to accept electronic 
reports. The effect of this rule will be to provide an electronic 
alternative to currently accepted methods of receiving regulatory 
reports on paper and to give the states the option of choosing to 
receive electronic submissions in satisfaction of reporting 
requirements under their authorized programs or continuing to require 
submissions on paper.
    Authorized states and local agencies that choose to receive 
electronic reports under this rule may incur expenses initially in 
developing systems or modifying existing systems to meet the standards 
in this rule. The average annual cost to state agencies in upgrading 
their electronic receiving systems and obtaining EPA program 
modification approval depends on the amount of effort required to 
adhere to the requirements of this rule. However, EPA estimates that 
for those states deploying systems that meet rule standards, each state 
will incur a cost of about $12,000 in obtaining EPA approval of its 
system. For a state where upgrades to its systems are needed to meet 
rule requirements, the costs can range up to $460,000, depending on the 
size and complexity of its systems and the extent of the upgrades 
needed. Maintenance costs for maintaining compliance with this rule 
will cost each state about $10,000 annually. These costs include both 
capital costs required for hardware and software upgrades, and labor 
costs incurred by state employees. EPA analyzed the most likely 
alternative scenario where, absent this rule, EPA programs would 
implement rules that would require states to seek program modifications 
on a program by program basis. It should be noted that these analyses 
do not quantify the cost savings that states will incur through 
offering electronic reporting options to their reporting entities. EPA 
believes these savings will greatly outweigh the costs of complying 
with the rule. Based on these analyses, EPA believes that although the 
final rule imposes some compliance costs on state and local 
governments, the costs for most states are marginal and will result in 
net benefits over the most likely alternative scenario.
    Over the last several years, EPA has provided substantial financial 
support to states to assist in upgrades to information technology 
systems. For example, in fiscal years 2002-2004, EPA provided 
approximately $65 million dollars to states, tribes, and territories 
through grants to support their efforts to establish EIEN. EPA intends 
to award additional grants for fiscal year 2005. EPA's fiscal year 2006 
budget includes $20 million for the EIEN Grant Program. States, tribes, 
and territories may apply for these grant funds to generally upgrade 
their EIEN capabilities, including improvements related to this rule, 
e.g., to improve data validity and user authentication procedures, as 
required by today's final rule.
    Although Section 6 of Executive Order 13132 does not apply to this 
rule, EPA has welcomed the active participation of the states; on 
several separate occasions EPA has held substantial consultations with 
state and local officials in developing this rule. State participation 
has resulted in changes to the final rule, including the section 3.1000 
approval process and

[[Page 59876]]

special provisions such as deferred compliance for existing systems.

C. Paperwork Reduction Act

    OMB has approved the information collection requirements contained 
in this rule under the provisions of the Paperwork Reduction Act (PRA), 
44 U.S.C. 3501 et seq. and has assigned OMB control number 2025-0003.
    The ICR for this rule covers the registration information, which 
will be collected from individuals wishing to submit electronic reports 
to EPA on behalf of regulated facilities. The information will be used 
to establish the identity of that individual and the regulated entity 
he or she represents. This information will be used by EPA to register 
and provide individuals with the ability to access the EPA's electronic 
document receiving system, CDX. In appropriate circumstances this 
information will also be used to issue an electronic signature to the 
registered individual. The ICR also covers activities incidental to 
electronic reporting (e.g., submittal of an electronic signature 
agreement to EPA as applicable). It should be noted that the submission 
of environmental reports in an electronic format to EPA and states, 
tribes, and local governments is voluntary for most examples of 
electronic reporting, and viewed as a service that EPA and its 
regulatory partners are providing to the regulated community. The rule 
allows reporting entities to submit reports and other information 
electronically, thereby streamlining and expediting the process for 
reporting. However, it should also be understood that this rule does 
set forth requirements for regulated entities that submit electronic 
reports directly to EPA and for states, tribes, and local governments 
that choose to implement electronic reporting under their authorized 
programs. EPA is issuing this rule on cross-media electronic reporting, 
in part, under the authority of GPEA, Public Law 105-277, which amends 
the PRA.
    In addition, the ICR covers state, tribe, and local government 
activities involved in upgrading their electronic receiving systems to 
satisfy the standards in the rule and in applying to EPA for approval 
of program modification. States, tribes, and local governments will 
undertake these activities only if they intend to collect information 
electronically under an EPA authorized program.
    The total annual reporting and recordkeeping burden this ICR 
estimates is 151,963 hours, which includes the tasks described above. 
It is expected that a respondent reporting directly to EPA will take on 
average ten minutes to register with CDX; however, if the respondent 
contacts the CDX help desk for assistance with CDX registration, on 
average the respondent will incur an additional six minutes. The 
average annual number of respondents registering with CDX is 19,434. It 
is further expected that 201,331 respondents will report electronically 
to a state, tribe, or local government receiving system. Respondents 
reporting to EPA or state, tribe, or local governments may also incur 
an additional burden of 20 minutes to prepare, sign, and submit an 
electronic signature agreement. The average annual number of these 
respondents is 177,009. In addition, the ICR estimates that 7,293 
medium-sized and large companies will register local registration 
authorities (LRA) and incur an additional burden of 1 hour. This 
includes the time to prepare and submit LRA designation applications, 
collect and store subscriber agreements, and prepare and submit 
certification of receipt and secure storage.
    Finally, it is expected that a state, tribe, or local government 
would take between 210 and 330 hours to prepare and submit its program 
modification application to EPA. The average annual number of states 
applying to EPA is expected to be 15; the average annual number of 
tribes and local governments applying to EPA is expected to be 46. In 
addition, the ICR estimates $4,450,658 in annual capital/start-up costs 
for states, tribes and local governments to upgrade their receiving 
systems. The ICR estimates $663,975 in annual operation and maintenance 
costs. This includes costs to registrants and state, tribes and local 
governments in submitting information to EPA.

Public Burden Statement

    The public reporting burden is estimated to be 10 minutes for an 
individual that reports electronically to the CDX. This includes time 
for preparing the on-line application and calling the CDX help desk.
    The public reporting burden in this ICR is estimated to be 15 
minutes for an individual that prepares and submits a subscriber 
agreement.
    The public reporting burden is estimated to be 30 minutes for a 
local registration authority. This includes time for preparing and 
submitting the certification of receipt and secure storage to EPA or 
state/local agency.
    The public reporting burden is estimated to range from 210 hours 
for a local government to 330 hours for a state seeking to implement an 
electronic receiving system. This includes time for preparing and 
submitting the program modification application to EPA.
    Burden means the total time, effort, or financial resources 
expended by persons to generate, maintain, retain, or disclose or 
provide information to or for a Federal agency. This includes the time 
needed to review instructions; develop, acquire, install, and utilize 
technology and systems for the purposes of collecting, validating, and 
verifying information, processing and maintaining information, and 
disclosing and providing information; adjust the existing ways to 
comply with any previously applicable instructions and requirements; 
train personnel to be able to respond to a collection of information; 
search data sources; complete and review the collection of information; 
and transmit or otherwise disclose the information.
    An agency may not conduct or sponsor, and a person is not required 
to respond to a collection of information unless it displays a 
currently valid OMB control number. The OMB control numbers for EPA's 
regulations are listed in 40 CFR part 9 and 48 CFR chapter 15. In 
addition, EPA is amending the table in 40 CFR part 9 of currently 
approved OMB control numbers for various regulations to list the 
regulatory citations for the information requirements contained in this 
final rule.

D. Regulatory Flexibility Act

    The Regulatory Flexibility Act (RFA), 5 U.S.C. 601 et seq., 
generally requires an agency to prepare a regulatory flexibility 
analysis of any rule subject to notice and comment rulemaking 
requirements under the Administrative Procedure Act or any other 
statute unless the agency certifies that the rule will not have a 
significant economic impact on a substantial number of small entities. 
Small entities include small businesses, small organizations, and small 
governmental jurisdictions.
    For the purpose of assessing the impacts of today's rule on small 
entities, small entity is defined as: (1) Small business as defined by 
the RFA and based on Small Business Administration (SBA) size 
standards; (2) a small governmental jurisdiction that is a government 
of a city, county, town, school district, or special district with a 
population of less then 50,000; and (3) a small organization that is 
any not-for-profit enterprise which is independently owned and operated 
and is not dominant in its field.
    After considering the economic impacts of today's final rule on 
small entities, the Agency certifies, pursuant to section 605(b) of the 
RFA, that this

[[Page 59877]]

action will not have a significant economic impact on a substantial 
number of small entities. Courts have interpreted the RFA to require a 
regulatory flexibility analysis only when small entities will be 
subject to the requirements of the rule. See Motor and Equip. Mfrs. 
Ass'n v. Nichols, 142 F.3d 449 (D.C. Cir. 1998); United Distribution 
Cos. v. FERC, 88 F.3d 1105, 1170 (D.C. Cir. 1996); Mid-Tex Elec. Co-op, 
Inc. v. FERC, 773 F.2d 327, 342 (D.C. Cir. 1985) (agency's 
certification need only consider the rule's impact on entities subject 
to the rule). This final rule would not establish any new direct 
requirements applicable to small entities. States that are directly 
regulated in this rulemaking are not small entities.
    This rule provides for EPA review and approval of authorized state, 
tribe, and local government programs that decide to provide for 
electronic reporting. This rule includes performance standards against 
which a state's, tribe's, or local government's electronic document 
receiving system will be evaluated before EPA will approve changes to 
the delegated, authorized, or approved program to provide electronic 
reporting, and establishes a streamlined process that states, tribes, 
and local governments can use to seek and obtain such approvals. The 
rule also includes special provisions for existing state electronic 
reporting systems in place at the time of publication of this rule.
    Currently, entities that choose to submit electronic documents 
directly to EPA submit documents to a centralized Agency-wide 
electronic document-receiving system, called the CDX, or to alternative 
systems designated by the Administrator. This rule does not change 
those systems. In addition, today's rule, does not require the 
submission of electronic documents in lieu of paper documents.
    Because there is no requirement to adopt electronic reporting, EPA 
has determined that small local governments will not be directly 
impacted by this rule. Nonetheless, EPA also considered the possible 
impacts of this rule to determine whether small local governments could 
potentially be subject to the provisions of Sec.  3.1000, which would 
require these programs to seek EPA approval for their electronic 
document receiving systems if they choose to provide electronic 
reporting. EPA reviewed its programs and conducted follow-up to 
comments received from industry, state, and local government 
associations to determine possible impacts to small local 
jurisdictions. Based on its review, EPA concluded that the only small 
government jurisdictions possibly subject to the rule are those with 
Publicly-Owned Treatment Works (POTWs). Only POTWs choosing to deploy 
electronic document receiving systems would be subject to today's rule. 
Through analysis and direct discussions with municipal POTWs and trade 
associations, EPA did not identify any such small government 
jurisdictions planning to deploy electronic reporting systems.
    Although not required by the RFA, (See Michigan v. EPA, 213 F.3d 
663, 668-69 (D.C. Cir., 2000), cert. den. 121 S.Ct. 225, 149 L.Ed.2d 
135 (2001)), as a part of the analysis prepared under Executive Order 
12866, EPA also considered the costs to small entities that are 
indirect reporters to authorized state, tribal, and local government 
programs. For this final rule, EPA prepared a cost/benefit analysis to 
assess the economic impact of CROMERR, which can be found in the docket 
for this rule.
    Although this rule will not have a significant economic impact on a 
substantial number of small entities, the Agency nonetheless consulted 
with small entities as well as organizations such as the Small Business 
Administration (SBA). We made several changes to the rule based upon 
these discussions.

E. Unfunded Mandates Reform Act

    Title II of the Unfunded Mandates Reform Act of 1995 (UMRA), Public 
Law 104-4, establishes requirements for federal agencies to assess the 
effects of their regulatory actions on states, tribes, and local 
governments and the private sector. Under section 202 of UMRA, EPA must 
prepare a written statement, including a cost-benefit analysis, for 
proposed and final rules with ``Federal mandates'' that may result in 
expenditures to states, tribes, and local governments, in the 
aggregate, or to the private sector, of $100 million or more in any one 
year. Before promulgating a rule for which a written statement is 
needed, section 205 of the UMRA generally requires EPA to identify and 
consider a reasonable number of regulatory alternatives and adopt the 
least costly, most cost-effective or least burdensome alternative that 
achieves the objectives of the rule. The provisions of section 205 do 
not apply when they are inconsistent with applicable law. Moreover, 
section 205 allows EPA to adopt an alternative other than the least 
costly, most cost-effective or least burdensome alternative if the 
Administrator publishes with the final rule an explanation why that 
alternative was not adopted.
    Before EPA establishes any regulatory requirements that may 
significantly or uniquely affect small governments, including tribes, 
it must have developed under section 203 of UMRA a small-government 
agency plan. The plan must provide for notifying potentially affected 
small governments, enabling officials of affected small governments to 
have meaningful and timely input into the development of EPA regulatory 
proposals with significant Federal intergovernmental mandates. The plan 
must also provide for informing, educating, and advising small 
governments on compliance with the regulatory requirements.
    As described in section VIII.D. of this Preamble, above, EPA also 
evaluated the possible impacts of this rule to small governments. In 
particular, EPA was concerned that small governments could potentially 
be subject to the provisions of Sec.  3.1000, which would require these 
programs to seek EPA approval for the electronic document receiving 
systems. EPA reviewed its programs, and also conducted follow-up to 
comments from industry, state, and local government associations to 
determine possible impacts to small local governments. As a result of 
this review, EPA concluded that small local governments would not be 
adversely impacted by the provisions of Sec.  3.1000 this rule.
    The Agency has determined that this rule does not contain a Federal 
mandate that may result in expenditures of $100 million or more for 
states, tribes, and local governments, in the aggregate, or the private 
sector in any one year. Thus, today's rule is not subject to the 
requirements in sections 202 and 205 of UMRA. The Agency has determined 
that this rule contains no regulatory requirements that might 
significantly or uniquely affect small governments and thus this rule 
is not subject to the requirements in section 202 of UMRA.

F. National Technology Transfer and Advancement Act

    Section 12(d) of the National Technology Transfer and Advancement 
Act of 1995 (NTTAA), Public Law 104-113, section 12(d) (15 U.S.C. 272 
note) directs EPA to use voluntary consensus standards in its 
regulatory activities unless to do so would be inconsistent with 
applicable law or otherwise impractical. Voluntary consensus standards 
are technical standards (e.g., materials specifications, test methods, 
sampling procedures, and business practices) that are developed or 
adopted by voluntary consensus standards bodies. The NTTAA directs EPA 
to provide Congress, through OMB, with explanations when the Agency 
decides

[[Page 59878]]

not to use available and applicable voluntary consensus standards.
    The consensus standards relevant to an electronic reporting rule 
are primarily technical standards that specify file formats for the 
electronic exchange of data, telecommunications network protocols, and 
electronic signature technologies and formats. EPA is not setting 
requirements for electronic reporting at the level of specificity 
addressed by such formats, protocols and technologies, so consensus 
standards are not directly applicable to today's rule. For example, the 
final rule does not stipulate data exchange formats, does not specify 
electronic signature technologies, and does not address 
telecommunications issues. At the same time, there is nothing in 
today's rule that is incompatible with these standards, and in 
implementing electronic reporting under this rule EPA is adopting 
standards-based approaches to electronic data exchange.
    In the preamble to the proposed rule, EPA described its initial 
plans to implement a number of standards-based approaches to electronic 
reporting, including electronic data exchange formats based upon the 
ANSI Accredited Standards Committee's (ASC) X12 for Electronic Data 
Interchange or EDI. That preamble also discussed EPA's interest in 
exploring the use of Internet data exchange formats based on XML, then 
under development by the World Wide Web Consortium (W3C). As a part of 
the preamble discussion, EPA solicited comment on these planned 
standards-based electronic reporting implementations. In response, EPA 
received considerable feedback both from states and from industry 
indicating a trend in the direction of XML, and away from the 
deployment of ANSI ASC X12 standards. In any event, CDX now looks to 
XML to provide the formats for its Internet data exchanges. EPA 
currently supports multi-agency Integrated Project Teams to develop XML 
formats and intends to use standardized formats for this purpose to the 
extent that they are available. In addition, EPA currently registers 
XML formats in its System of Registries to facilitate easy access to 
these formats for partners wishing to exchange data. EPA is attempting 
to make use of applicable standards-setting work being done by several 
organizations, including the Electronic Business XML (ebXML), the 
Organization for the Advancement of Structured Information Standards 
(OASIS), and, internationally, the United Nation's Center for 
Administration, Commerce, and Transport (UN/CEFACT) Forum. In any 
event, today's rule is compatible with any of these current standards-
based approaches to electronic reporting, but the rule itself does not 
set requirements at the level of detail that such standards address.

G. Executive Order 13045

    Executive Order 13045, Protection of Children from Environmental 
Health Risks and Safety Risks (62 FR 19885, April 23, 1997) applies to 
any rule that EPA determines (1) ``economically significant'' as 
defined under Executive Order 12866 and (2) concerns an environmental 
health or safety risk that EPA has reason to believe may have a 
disproportionate effect on children. EPA interprets Executive Order 
13045 as encompassing only those regulatory actions that are risk-based 
or health-based, such that the analysis required under Section 5-501 of 
the Executive Order has the potential to influence the regulation.
    This rule is not subject to Executive Order 13045 because it is not 
an economically significant action as defined by Executive Order 12866 
and it does not involve decisions regarding environmental health or 
safety risks. This rule contains general performance standards for the 
submission of environmental data electronically.

H. Executive Order 13175

    Executive Order 13175, entitled, ``Consultation and Coordination 
with Indian Tribal Governments'' (65 FR 67249, November 6, 2000), 
requires EPA to develop an accountable process to ensure ``meaningful 
and timely input by tribal officials in the development of regulatory 
policies that have tribal implications.'' ``Policies that have tribal 
implications'' are defined in the Executive Order to include 
regulations that have ``substantial direct effects on one or more 
Indian tribes, on the relationship between the Federal Government and 
the Indian tribes, or on the distribution of power and responsibilities 
between the Federal Government and Indian tribes.''
    This rule does not have tribal implications, as specified in 
Executive Order 13175, and therefore consultation under the Order is 
not required. It will not have substantial direct effects on tribes, on 
the relationship between the federal government and Indian tribes, or 
on the distribution of power and responsibilities between the federal 
government and Indian tribes, as specified in Executive Order 13175. 
This action does not require Indian tribes to accept electronic 
reports. The effect of this rule is to provide additional regulatory 
flexibility to Indian tribes by giving them the opportunity to submit 
electronic reports to EPA in satisfaction of EPA reporting requirements 
and by allowing them to implement electronic reporting under their 
authorized programs.

I. Executive Order 13211 (Energy Effects)

    This rule is not a ``significant energy action'' as defined in 
Executive Order 13211, ``Actions Concerning Regulations That 
Significantly Affect Energy Supply, Distribution, or Use'' (66 FR 
28355, May 22, 2001) because it is not likely to have a significant 
adverse affect on the supply, distribution, or use of energy. EPA has 
concluded that this rule is not likely to have any adverse energy 
effects.

J. Congressional Review Act

    The Congressional Review Act, 5 U.S.C. 801 et seq., as added by the 
Small Business Regulatory Enforcement Fairness Act of 1996, generally 
provides that before a rule may take effect, the agency promulgating 
the rule must submit a rule report, which includes a copy of the rule, 
to each House of the Congress and to the Comptroller General of the 
United States. EPA will submit a report containing this rule and other 
required information to the U.S. Senate, the U.S. House of 
Representatives, and the Comptroller General of the United States prior 
to publication of the rule in the Federal Register. A major rule cannot 
take effect until 60 days after it is published in the Federal 
Register. This action is not a ``major rule'' as defined by 5 U.S.C. 
804(2). This rule will become effective on January 11, 2006.

List of Subjects

40 CFR Part 3

    Environmental protection, Conflict of interests, Electronic 
records, Electronic reporting requirements, Electronic reports, 
Intergovernmental relations.

40 CFR Part 9

    Environmental protection, Electronic records, Electronic reporting 
requirements, Electronic reports, Intergovernmental relations, 
Reporting and recordkeeping requirements.

40 CFR Part 51

    Environmental protection, Administrative practice and procedure, 
Air pollution control, Carbon monoxide, Electronic records, Electronic 
reporting requirements, Electronic reports, Intergovernmental 
relations, Lead, Nitrogen dioxide, Ozone, Particulate matter, Reporting 
and recordkeeping

[[Page 59879]]

requirements, Sulfur oxides, Volatile organic compounds.

40 CFR Part 60

    Environmental protection, Administrative practice and procedure, 
Air pollution control, Aluminum, Ammonium sulfate plants, Batteries, 
Beverages, Carbon monoxide, Cement industry, Coal, Copper, Dry 
cleaners, Electric power plants, Electronic records, Electronic 
reporting requirements, Electronic reports, Fertilizers, Fluoride, 
Gasoline, Glass and glass products, Grains, Graphic arts industry, 
Heaters, Household appliances, Insulation, Intergovernmental relations, 
Iron, Labeling, Lead, Lime, Metallic and nonmetallic mineral processing 
plants, Metals, Motor vehicles, Natural gas, Nitric acid plants, 
Nitrogen dioxide, Paper and paper products industry, Particulate 
matter, Paving and roofing materials, Petroleum, Phosphate, Plastics 
materials and synthetics, Polymers, Reporting and recordkeeping 
requirements, Sewage disposal, Steel, Sulfur oxides, Sulfuric acid 
plants, Tires, Urethane, Vinyl, Volatile organic compounds, Waste 
treatment and disposal, Zinc.

40 CFR Part 63

    Environmental protection, Air pollution control, Electronic 
records, Electronic reporting requirements, Electronic reports, 
Hazardous substances, Intergovernmental relations, Reporting and 
recordkeeping requirements.

40 CFR Part 69

    Environmental protection, Air pollution control, Electronic 
records, Electronic reporting requirements, Electronic reports, Guam, 
Intergovernmental relations.

40 CFR Part 70

    Environmental protection, Administrative practice and procedure, 
Electronic records, Electronic reporting requirements, Electronic 
reports, Intergovernmental relations.

40 CFR Part 71

    Environmental protection, Administrative practice and procedure, 
Electronic records, Electronic reporting requirements, Electronic 
reports, Intergovernmental relations.

40 CFR Part 123

    Environmental protection, Administrative practice and procedure, 
Confidential business information, Electronic records, Electronic 
reporting requirements, Electronic reports, Hazardous substances, 
Indians-lands, Intergovernmental relations, Penalties, Reporting and 
recordkeeping requirements, Water pollution control.

40 CFR Part 142

    Environmental protection, Administrative practice and procedure, 
Chemicals, Electronic records, Electronic reporting requirements, 
Electronic reports, Indians-lands, Intergovernmental relations, 
Radiation protection, Reporting and recordkeeping requirements, Water 
supply.

40 CFR Part 145

    Environmental protection, Confidential business information, 
Electronic records, Electronic reporting requirements, Electronic 
reports, Indians-lands, Intergovernmental relations, Penalties, 
Reporting and recordkeeping requirements, Water supply.

40 CFR Part 162

    Environmental protection, Administrative practice and procedure, 
Electronic records, Electronic reporting requirements, Electronic 
reports, Intergovernmental relations, Pesticides and pests, Reporting 
and recordkeeping requirements, State registration of pesticide 
products.

40 CFR Part 233

    Environmental protection, Administrative practice and procedure, 
Electronic records, Electronic reporting requirements, Electronic 
reports, Intergovernmental relations, Penalties, Reporting and 
recordkeeping requirements, Water pollution control.

40 CFR Part 257

    Environmental protection, Electronic records, Electronic reporting 
requirements, Electronic reports, Intergovernmental relations, Waste 
treatment and disposal.

40 CFR Part 258

    Environmental protection, Electronic records, Electronic reporting 
requirements, Electronic reports, Intergovernmental relations, 
Reporting and recordkeeping requirements, Waste treatment and disposal, 
Water pollution control.

40 CFR Part 271

    Environmental protection, Administrative practice and procedure, 
Confidential business information, Electronic records, Electronic 
reporting requirements, Electronic reports, Hazardous materials 
transportation, Hazardous waste, Indians-lands, Intergovernmental 
relations, Penalties, Reporting and recordkeeping requirements, Water 
pollution control, Water supply.

40 CFR Part 281

    Environmental protection, Administrative practice and procedure, 
Electronic records, Electronic reporting requirements, Electronic 
reports, Hazardous substances, Insurance, Intergovernmental relations, 
Oil pollution, Reporting and recordkeeping requirements, Surety bonds, 
Water pollution control, Water supply.

40 CFR Part 403

    Environmental protection, Confidential business information, 
Electronic records, Electronic reporting requirements, Electronic 
reports, Intergovernmental relations, Reporting and recordkeeping 
requirements, Waste treatment and disposal, Water pollution control.

40 CFR Part 501

    Environmental protection, Administrative practice and procedure, 
Electronic records, Electronic reporting requirements, Electronic 
reports, Intergovernmental relations, Penalties, Reporting and 
recordkeeping requirements, Sewage disposal.

40 CFR Part 745

    Environmental protection, Electronic records, Electronic reporting 
requirements, Electronic reports, Intergovernmental relations, 
Hazardous substances, Lead poisoning, Reporting and recordkeeping 
requirements.

40 CFR Part 763

    Environmental protection, Administrative practice and procedure, 
Asbestos, Electronic records, Electronic reporting requirements, 
Electronic reports, Hazardous substances, Imports, Intergovernmental 
relations, Reporting and recordkeeping requirements.

    Dated: September 22, 2005.
Stephen L. Johnson,
Administrator.

0
Therefore, Title 40 Chapter I of the Code of Federal Regulations is 
amended by adding a new Part 3, and amending parts 9, 51, 60, 63, 69, 
70, 71, 123, 142, 145, 162, 233, 257, 258, 271, 281, 403, 501, 745, and 
763 to read as follows:

PART 3--CROSS-MEDIA ELECTRONIC REPORTING

Subpart A--General Provisions
Sec.
3.1 Who does this part apply to?
3.2 How does this part provide for electronic reporting?
3.3 What definitions are applicable to this part?

[[Page 59880]]

3.4 How does this part affect enforcement and compliance provisions 
of Title 40?
Subpart B--Electronic Reporting to EPA
3.10 What are the requirements for electronic reporting to EPA?
3.20 How will EPA provide notice of changes to the Central Data 
Exchange?
Subpart C--[Reserved]
Subpart D--Electronic Reporting under EPA-Authorized State, Tribe, and 
Local Programs
3.1000 How does a state, tribe, or local government revise or modify 
its authorized program to allow electronic reporting?
3.2000 What are the requirements authorized state, tribe, and local 
programs' reporting systems must meet?

    Authority: 7 U.S.C. 136 to 136y; 15 U.S.C. 2601 to 2692; 33 
U.S.C. 1251 to 1387; 33 U.S.C. 1401 to 1445; 33 U.S.C. 2701 to 2761; 
42 U.S.C. 300f to 300j-26; 42 U.S.C. 4852d; 42 U.S.C. 6901-6992k; 42 
U.S.C. 7401 to 7671q; 42 U.S.C. 9601 to 9675; 42 U.S.C. 11001 to 
11050; 15 U.S.C. 7001; 44 U.S.C. 3504 to 3506.

Subpart A--General Provisions


Sec.  3.1  Who does this part apply to?

    (a) This part applies to:
    (1) Persons who submit reports or other documents to EPA to satisfy 
requirements under Title 40 of the Code of Federal Regulations (CFR); 
and
    (2) States, tribes, and local governments administering or seeking 
to administer authorized programs under Title 40 of the CFR.
    (b) This part does not apply to:
    (1) Documents submitted via facsimile in satisfaction of reporting 
requirements as permitted under other parts of Title 40 or under 
authorized programs; or
    (2) Electronic documents submitted via magnetic or optical media 
such as diskette, compact disc, digital video disc, or tape in 
satisfaction of reporting requirements, as permitted under other parts 
of Title 40 or under authorized programs.
    (c) This part does not apply to any data transfers between EPA and 
states, tribes, or local governments as a part of their authorized 
programs or as a part of administrative arrangements between states, 
tribes, or local governments and EPA to share data.


Sec.  3.2  How does this part provide for electronic reporting?

    (a) Electronic reporting to EPA. Except as provided in Sec.  
3.1(b), any person who is required under Title 40 to create and submit 
or otherwise provide a document to EPA may satisfy this requirement 
with an electronic document, in lieu of a paper document, provided 
that:
    (1) He or she satisfies the requirements of Sec.  3.10; and
    (2) EPA has first published a notice in the Federal Register 
announcing that EPA is prepared to receive, in electronic form, 
documents required or permitted by the identified part or subpart of 
Title 40.
    (b) Electronic reporting under an EPA-authorized state, tribe, or 
local program.
    (1) An authorized program may allow any document submission 
requirement under that program to be satisfied with an electronic 
document provided that the state, tribe, or local government seeks and 
obtains revision or modification of that program in accordance with 
Sec.  3.1000 and also meets the requirements of Sec.  3.2000 for such 
electronic reporting.
    (2) A state, tribe, or local government that is applying for 
initial delegation, authorization, or approval to administer a federal 
program or a program in lieu of the federal program, and that will 
allow document submission requirements under the program to be 
satisfied with an electronic document, must use the procedures for 
obtaining delegation, authorization, or approval under the relevant 
part of Title 40 and may not use the procedures set forth in Sec.  
3.1000; but the application must contain the information required by 
Sec.  3.1000(b)(1) and the state, tribe, or local government must meet 
the requirements of Sec.  3.2000.
    (c) Limitations. This part does not require submission of 
electronic documents in lieu of paper. This part confers no right or 
privilege to submit data electronically and does not obligate EPA, 
states, tribes, or local governments to accept electronic documents.


Sec.  3.3  What definitions are applicable to this part?

    The definitions set forth in this section apply when used in this 
part.
    Acknowledgment means a confirmation of electronic document receipt.
    Administrator means the Administrator of the EPA.
    Agency means the EPA or a state, tribe, or local government that 
administers or seeks to administer an authorized program.
    Agreement collection certification means a signed statement by 
which a local registration authority certifies that a subscriber 
agreement has been received from a registrant; the agreement has been 
stored in a manner that prevents unauthorized access to these 
agreements by anyone other than the local registration authority; and 
the local registration authority has no basis to believe that any of 
the collected agreements have been tampered with or prematurely 
destroyed.
    Authorized program means a Federal program that EPA has delegated, 
authorized, or approved a state, tribe, or local government to 
administer, or a program that EPA has delegated, authorized, or 
approved a state, tribe or local government to administer in lieu of a 
Federal program, under other provisions of Title 40 and such 
delegation, authorization, or approval has not been withdrawn or 
expired.
    Central Data Exchange means EPA's centralized electronic document 
receiving system, or its successors, including associated instructions 
for submitting electronic documents.
    Chief Information Officer means the EPA official assigned the 
functions described in section 5125 of the Clinger Cohen Act (Pub. L. 
104-106).
    Copy of record means a true and correct copy of an electronic 
document received by an electronic document receiving system, which 
copy can be viewed in a human-readable format that clearly and 
accurately associates all the information provided in the electronic 
document with descriptions or labeling of the information. A copy of 
record includes:
    (1) All electronic signatures contained in or logically associated 
with that document;
    (2) The date and time of receipt; and
    (3) Any other information used to record the meaning of the 
document or the circumstances of its receipt.
    Disinterested individual means an individual who is not connected 
with the person in whose name the electronic signature device is 
issued. A disinterested individual is not any of the following: The 
person's employer or employer's corporate parent, subsidiary, or 
affiliate; the person's contracting agent; member of the person's 
household; or relative with whom the person has a personal 
relationship.
    Electronic document means any information in digital form that is 
conveyed to an agency or third-party, where ``information'' may include 
data, text, sounds, codes, computer programs, software, or databases. 
``Data,'' in this context, refers to a delimited set of data elements, 
each of which consists of a content or value together with an 
understanding of what the content or value means; where the electronic 
document includes data, this understanding of what the data element 
content or value means must be explicitly included in the electronic 
document itself or else be readily available to the electronic document 
recipient.
    Electronic document receiving system means any set of apparatus, 
procedures,

[[Page 59881]]

software, records, or documentation used to receive electronic 
documents.
    Electronic signature means any information in digital form that is 
included in or logically associated with an electronic document for the 
purpose of expressing the same meaning and intention as would a 
handwritten signature if affixed to an equivalent paper document with 
the same reference to the same content. The electronic document bears 
or has on it an electronic signature where it includes or has logically 
associated with it such information.
    Electronic signature agreement means an agreement signed by an 
individual with respect to an electronic signature device that the 
individual will use to create his or her electronic signatures 
requiring such individual to protect the electronic signature device 
from compromise; to promptly report to the agency or agencies relying 
on the electronic signatures created any evidence discovered that the 
device has been compromised; and to be held as legally bound, 
obligated, or responsible by the electronic signatures created as by a 
handwritten signature.
    Electronic signature device means a code or other mechanism that is 
used to create electronic signatures. Where the device is used to 
create an individual's electronic signature, then the code or mechanism 
must be unique to that individual at the time the signature is created 
and he or she must be uniquely entitled to use it. The device is 
compromised if the code or mechanism is available for use by any other 
person.
    EPA means the United States Environmental Protection Agency.
    Existing electronic document receiving system means an electronic 
document receiving system that is being used to receive electronic 
documents in lieu of paper to satisfy requirements under an authorized 
program on October 13, 2005 or the system, if not in use, has been 
substantially developed on or before that date as evidenced by the 
establishment of system services or specifications by contract or other 
binding agreement.
    Federal program means any program administered by EPA under any 
other provision of Title 40.
    Federal reporting requirement means a requirement to report 
information directly to EPA under any other provision of Title 40.
    Handwritten signature means the scripted name or legal mark of an 
individual, handwritten by that individual with a marking-or writing-
instrument such as a pen or stylus and executed or adopted with the 
present intention to authenticate a writing in a permanent form, where 
``a writing'' means any intentional recording of words in a visual 
form, whether in the form of handwriting, printing, typewriting, or any 
other tangible form. The physical instance of the scripted name or mark 
so created constitutes the handwritten signature. The scripted name or 
legal mark, while conventionally applied to paper, may also be applied 
to other media.
    Information or objects of independent origin means data or items 
that originate from a disinterested individual or are forensic evidence 
of a unique, immutable trait which is (and may at any time be) 
attributed to the individual in whose name the device is issued.
    Local registration authority means an individual who is authorized 
by a state, tribe, or local government to issue an agreement collection 
certification, whose identity has been established by notarized 
affidavit, and who is authorized in writing by a regulated entity to 
issue agreement collection certifications on its behalf.
    Priority reports means the reports listed in Appendix 1 to part 3.
    Subscriber agreement means an electronic signature agreement signed 
by an individual with a handwritten signature. This agreement must be 
stored until five years after the associated electronic signature 
device has been deactivated.
    Transmit means to successfully and accurately convey an electronic 
document so that it is received by the intended recipient in a format 
that can be processed by the electronic document receiving system.
    Valid electronic signature means an electronic signature on an 
electronic document that has been created with an electronic signature 
device that the identified signatory is uniquely entitled to use for 
signing that document, where this device has not been compromised, and 
where the signatory is an individual who is authorized to sign the 
document by virtue of his or her legal status and/or his or her 
relationship to the entity on whose behalf the signature is executed.


Sec.  3.4  How does this part affect enforcement and compliance 
provisions of Title 40?

    (a) A person is subject to any applicable federal civil, criminal, 
or other penalties and remedies for failure to comply with a federal 
reporting requirement if the person submits an electronic document to 
EPA under this part that fails to comply with the provisions of Sec.  
3.10.
    (b) A person is subject to any applicable federal civil, criminal, 
or other penalties or remedies for failure to comply with a State, 
tribe, or local reporting requirement if the person submits an 
electronic document to a State, tribe, or local government under an 
authorized program and fails to comply with the applicable provisions 
for electronic reporting.
    (c) Where an electronic document submitted to satisfy a federal or 
authorized program reporting requirement bears an electronic signature, 
the electronic signature legally binds, obligates, and makes the 
signatory responsible, to the same extent as the signatory's 
handwritten signature would on a paper document submitted to satisfy 
the same federal or authorized program reporting requirement.
    (d) Proof that a particular signature device was used to create an 
electronic signature will suffice to establish that the individual 
uniquely entitled to use the device did so with the intent to sign the 
electronic document and give it effect.
    (e) Nothing in this part limits the use of electronic documents or 
information derived from electronic documents as evidence in 
enforcement or other proceedings.

Subpart B--Electronic Reporting to EPA


Sec.  3.10  What are the requirements for electronic reporting to EPA?

    (a) A person may use an electronic document to satisfy a federal 
reporting requirement or otherwise substitute for a paper document or 
submission permitted or required under other provisions of Title 40 
only if:
    (1) The person transmits the electronic document to EPA's Central 
Data Exchange, or to another EPA electronic document receiving system 
that the Administrator may designate for the receipt of specified 
submissions, complying with the system's requirements for submission; 
and
    (2) The electronic document bears all valid electronic signatures 
that are required under paragraph (b) of this section.
    (b) An electronic document must bear the valid electronic signature 
of a signatory if that signatory would be required under Title 40 to 
sign the paper document for which the electronic document substitutes, 
unless EPA announces special provisions to accept a handwritten 
signature on a separate paper submission and the signatory provides 
that handwritten signature.


Sec.  3.20  How will EPA provide notice of changes to the Central Data 
Exchange?

    (a) Except as provided under paragraph (b) of this section, 
whenever

[[Page 59882]]

EPA plans to change Central Data Exchange hardware or software in ways 
that would affect the transmission process, EPA will provide notice as 
follows:
    (1) Significant changes to CDX: Where the equipment, software, or 
services needed to transmit electronic documents to the Central Data 
Exchange would be changed significantly, EPA will provide public notice 
and seek comment on the change and the proposed implementation schedule 
through the Federal Register;
    (2) Other changes to CDX: EPA will provide notice of other changes 
to Central Data Exchange users at least sixty (60) days in advance of 
implementation.
    (3) De minimis or transparent changes to CDX: For de minimis or 
transparent changes that have minimal or no impact on the transmission 
process, EPA may provide notice if appropriate on a case-by-case basis.
    (b) Emergency changes to CDX: Any change which EPA's Chief 
Information Officer or his or her designee determines is needed to 
ensure the security and integrity of the Central Data Exchange is 
exempt from the provisions of paragraph (a) of this section. However, 
to the extent consistent with ensuring the security and integrity of 
the system, EPA will provide notice for any change other than de 
minimis or transparent changes to the Central Data Exchange.

Subpart C--[Reserved]

Subpart D--Electronic Reporting Under EPA-Authorized State, Tribe, 
and Local Programs


Sec.  3.1000  How does a state, tribe, or local government revise or 
modify its authorized program to allow electronic reporting?

    (a) A state, tribe, or local government that receives or plans to 
begin receiving electronic documents in lieu of paper documents to 
satisfy requirements under an authorized program must revise or modify 
such authorized program to ensure that it meets the requirements of 
this part.
    (1) General procedures for program modification or revision: To 
revise or modify an authorized program to meet the requirements of this 
part, a state, tribe, or local government must submit an application 
that complies with paragraph (b)(1) of this section and must follow 
either the applicable procedures for program revision or modification 
in other parts of Title 40, or, at the applicant's option, the 
procedures provided in paragraphs (b) through (e) of this section.
    (2) Programs planning to receive electronic documents under an 
authorized program: A state, tribe, or local government that does not 
have an existing electronic document receiving system for an authorized 
program must receive EPA approval of revisions or modifications to such 
program in compliance with paragraph (a)(1) of this section before the 
program may receive electronic documents in lieu of paper documents to 
satisfy program requirements.
    (3) Programs already receiving electronic documents under an 
authorized program: A state, tribe, or local government with an 
existing electronic document receiving system for an authorized program 
must submit an application to revise or modify such authorized program 
in compliance with paragraph (a)(1) of this section no later than 
October 13, 2007. On a case-by-case basis, this deadline may be 
extended by the Administrator, upon request of the state, tribe, or 
local government, where the Administrator determines that the state, 
tribe, or local government needs additional time to make legislative or 
regulatory changes to meet the requirements of this part.
    (4) Programs with approved electronic document receiving systems: 
An authorized program that has EPA's approval to accept electronic 
documents in lieu of paper documents must keep EPA apprised of those 
changes to laws, policies, or the electronic document receiving systems 
that have the potential to affect program compliance with Sec.  3.2000. 
Where the Administrator determines that such changes require EPA review 
and approval, EPA may request that the state, tribe, or local 
government submit an application for program revision or modification; 
additionally, a state, tribe, or local government on its own initiative 
may submit an application for program revision or modification 
respecting their receipt of electronic documents. Such applications 
must comply with paragraph (a)(1) of this section.
    (5) Restrictions on the use of procedures in this section: The 
procedures provided in paragraphs (b) through (e) of this section may 
only be used for revising or modifying an authorized program to provide 
for electronic reporting and for subsequent revisions or modifications 
to the electronic reporting elements of an authorized program as 
provided under paragraph (a)(4) of this section.
    (b)(1) To obtain EPA approval of program revisions or modifications 
using procedures provided under this section, a state, tribe, or local 
government must submit an application to the Administrator that 
includes the following elements:
    (i) A certification that the state, tribe, or local government has 
sufficient legal authority provided by lawfully enacted or promulgated 
statutes or regulations that are in full force and effect on the date 
of the certification to implement the electronic reporting component of 
its authorized programs covered by the application in conformance with 
Sec.  3.2000 and to enforce the affected programs using electronic 
documents collected under these programs, together with copies of the 
relevant statutes and regulations, signed by the State Attorney General 
or his or her designee, or, in the case of an authorized tribe or local 
government program, by the chief executive or administrative official 
or officer of the governmental entity, or his or her designee;
    (ii) A listing of all the state, tribe, or local government 
electronic document receiving systems to accept the electronic 
documents being addressed by the program revisions or modifications 
that are covered by the application, together with a description for 
each such system that specifies how the system meets the applicable 
requirements in Sec.  3.2000 with respect to those electronic 
documents;
    (iii) A schedule of upgrades for the electronic document receiving 
systems listed under paragraph (b)(1)(ii) of this section that have the 
potential to affect the program's continued conformance with Sec.  
3.2000; and
    (iv) Other information that the Administrator may request to fully 
evaluate the application.
    (2) A state, tribe, or local government that revises or modifies 
more than one authorized program for receipt of electronic documents in 
lieu of paper documents may submit a consolidated application under 
this section covering more than one authorized program, provided the 
consolidated application complies with paragraph (b)(1) of this section 
for each authorized program.
    (3)(i) Within 75 calendar days of receiving an application for 
program revision or modification submitted under paragraph (b)(1) of 
this section, the Administrator will respond with a letter that either 
notifies the state, tribe, or local government that the application is 
complete or identifies deficiencies in the application that render the 
application incomplete. The state, tribe, or local government receiving 
a notice of deficiencies may amend the application and resubmit it. 
Within 30 calendar days of receiving the amended application, the 
Administrator will respond with a letter that either notifies the 
applicant that the amended

[[Page 59883]]

application is complete or identifies remaining deficiencies that 
render the application incomplete.
    (ii) If a state, tribe, or local government receiving notice of 
deficiencies under paragraph (b)(3)(i) of this section does not remedy 
the deficiencies and resubmit the subject application within a 
reasonable period of time, the Administrator may act on the incomplete 
application under paragraph (c) of this section.
    (c)(1) The Administrator will act on an application by approving or 
denying the state's, tribe's or local government's request for program 
revision or modification.
    (2) Where a consolidated application submitted under paragraph 
(b)(2) of this section addresses revisions or modifications to more 
than one authorized program, the Administrator may approve or deny the 
request for revision or modification of each authorized program in the 
application separately; the Administrator need not take the same action 
with respect to the requested revisions or modifications for each such 
program.
    (3) When an application under paragraph (b) of this section 
requests revision or modification of an authorized public water system 
program under part 142 of this title, the Administrator will, in 
accordance with the procedures in paragraph (f) of this section, 
provide an opportunity for a public hearing before a final 
determination pursuant to paragraph (c)(1) of this section with respect 
to that component of the application.
    (4) Except as provided under paragraph (c)(4)(i) and (ii) of this 
section, if the Administrator does not take any action under paragraph 
(c)(1) of this section on a specific request for revision or 
modification of a specific authorized program addressed by an 
application submitted under paragraph (b) of this section within 180 
calendar days of notifying the state, tribe, or local government under 
paragraph (b)(3) of this section that the application is complete, the 
specific request for program revision or modification for the specific 
authorized program is considered automatically approved by EPA at the 
end of the 180 calendar days unless the review period is extended at 
the request of the state, tribe, or local government submitting the 
application.
    (i) Where an opportunity for public hearing is required under 
paragraph (c)(3) of this section, the Administrator's action on the 
requested revision or modification will be in accordance with paragraph 
(f) of this section.
    (ii) Where a requested revision or modification addressed by an 
application submitted under paragraph (b) of this section is to an 
authorized program with an existing electronic document receiving 
system, and where notification under paragraph (b)(3) of this section 
that the application is complete is executed after October 13, 2007, if 
the Administrator does not take any action under paragraph (c)(1) of 
this section on the specific request for revision or modification 
within 360 calendar days of such notification, the specific request is 
considered automatically approved by EPA at the end of the 360 calendar 
days unless the review period is extended at the request of the state, 
tribe, or local government submitting the application.
    (d) Except where an opportunity for public hearing is required 
under paragraph (c)(3) of this section, EPA's approval of a program 
revision or modification under this section will be effective upon 
publication of a notice of EPA's approval of the program revision or 
modification in the Federal Register. EPA will publish such a notice 
promptly after approving a program revision or modification under 
paragraph (c)(1) of this section or after an EPA approval occurs 
automatically under paragraph (c)(4) of this section.
    (e) If a state, tribe, or local government submits material to 
amend its application under paragraph (b)(1) of this section after the 
date that the Administrator sends notification under paragraph 
(b)(3)(i) of this section that the application is complete, this new 
submission will constitute withdrawal of the pending application and 
submission of a new, amended application for program revision or 
modification under paragraph (b)(1) of this section, and the 180-day 
time period in paragraph (c)(4) of this section or the 360-day time 
period in paragraph (c)(4)(ii) of this section will begin again only 
when the Administrator makes a new determination and notifies the 
state, tribe, or local government under paragraph (b)(3)(i) of this 
section that the amended application is complete.
    (f) For an application under this section that requests revision or 
modification of an authorized public water system program under part 
142 of this chapter:
    (1) The Administrator will publish notice of the Administrator's 
preliminary determination under paragraph (c)(1) of this section in the 
Federal Register, stating the reasons for the determination and 
informing interested persons that they may request a public hearing on 
the Administrator's determination. Frivolous or insubstantial requests 
for a hearing may be denied by the Administrator;
    (2) Requests for a hearing submitted under this section must be 
submitted to the Administrator within 30 days after publication of the 
notice of opportunity for hearing in the Federal Register. The 
Administrator will give notice in the Federal Register of any hearing 
to be held pursuant to a request submitted by an interested person or 
on the Administrator's own motion. Notice of hearing will be given not 
less than 15 days prior to the time scheduled for the hearing;
    (3) The hearing will be conducted by a designated hearing officer 
in an informal, orderly, and expeditious manner. The hearing officer 
will have authority to take such action as may be necessary to assure 
the fair and efficient conduct of the hearing; and
    (4) After reviewing the record of the hearing, the Administrator 
will issue an order either affirming the determination the 
Administrator made under paragraph (c)(1) of this section or rescinding 
such determination and will promptly publish a notice of the order in 
the Federal Register. If the order is to approve the program revision 
or modification, EPA's approval will be effective upon publication of 
the notice in the Federal Register. If no timely request for a hearing 
is received and the Administrator does not determine to hold a hearing 
on the Administrator's own motion, the Administrator's determination 
made under paragraph (c)(1) of this section will be effective 30 days 
after notice is published pursuant to paragraph (f)(1) of this section.


Sec.  3.2000  What are the requirements authorized state, tribe, and 
local programs' reporting systems must meet?

    (a) Authorized programs that receive electronic documents in lieu 
of paper to satisfy requirements under such programs must:
    (1) Use an acceptable electronic document receiving system as 
specified under paragraphs (b) and (c) of this section; and
    (2) Require that any electronic document must bear the valid 
electronic signature of a signatory if that signatory would be required 
under the authorized program to sign the paper document for which the 
electronic document substitutes, unless the program has been approved 
by EPA to accept a handwritten signature on a separate paper 
submission. The paper submission must contain references to the 
electronic document sufficient for legal certainty that the signature 
was executed with the intention to certify to, attest to, or agree to 
the content of that electronic document.

[[Page 59884]]

    (b) An electronic document receiving system that receives 
electronic documents submitted in lieu of paper documents to satisfy 
requirements under an authorized program must be able to generate data 
with respect to any such electronic document, as needed and in a timely 
manner, including a copy of record for the electronic document, 
sufficient to prove, in private litigation, civil enforcement 
proceedings, and criminal proceedings, that:
    (1) The electronic document was not altered without detection 
during transmission or at any time after receipt;
    (2) Any alterations to the electronic document during transmission 
or after receipt are fully documented;
    (3) The electronic document was submitted knowingly and not by 
accident;
    (4) Any individual identified in the electronic document submission 
as a submitter or signatory had the opportunity to review the copy of 
record in a human-readable format that clearly and accurately 
associates all the information provided in the electronic document with 
descriptions or labeling of the information and had the opportunity to 
repudiate the electronic document based on this review; and
    (5) In the case of an electronic document that must bear electronic 
signatures of individuals as provided under paragraph (a)(2) of this 
section, that:
    (i) Each electronic signature was a valid electronic signature at 
the time of signing;
    (ii) The electronic document cannot be altered without detection at 
any time after being signed;
    (iii) Each signatory had the opportunity to review in a human-
readable format the content of the electronic document that he or she 
was certifying to, attesting to or agreeing to by signing;
    (iv) Each signatory had the opportunity, at the time of signing, to 
review the content or meaning of the required certification statement, 
including any applicable provisions that false certification carries 
criminal penalties;
    (v) Each signatory has signed either an electronic signature 
agreement or a subscriber agreement with respect to the electronic 
signature device used to create his or her electronic signature on the 
electronic document;
    (vi) The electronic document receiving system has automatically 
responded to the receipt of the electronic document with an 
acknowledgment that identifies the electronic document received, 
including the signatory and the date and time of receipt, and is sent 
to at least one address that does not share the same access controls as 
the account used to make the electronic submission; and
    (vii) For each electronic signature device used to create an 
electronic signature on the document, the identity of the individual 
uniquely entitled to use the device and his or her relation to any 
entity for which he or she will sign electronic documents has been 
determined with legal certainty by the issuing state, tribe, or local 
government. In the case of priority reports identified in the table in 
Appendix 1 of Part 3, this determination has been made before the 
electronic document is received, by means of:
    (A) Identifiers or attributes that are verified (and that may be 
re-verified at any time) by attestation of disinterested individuals to 
be uniquely true of (or attributable to) the individual in whose name 
the application is submitted, based on information or objects of 
independent origin, at least one item of which is not subject to change 
without governmental action or authorization; or
    (B) A method of determining identity no less stringent than would 
be permitted under paragraph (b)(5)(vii)(A) of this section; or
    (C) Collection of either a subscriber agreement or a certification 
from a local registration authority that such an agreement has been 
received and securely stored.
    (c) An authorized program that receives electronic documents in 
lieu of paper documents must ensure that:
    (1) A person is subject to any appropriate civil, criminal 
penalties or other remedies under state, tribe, or local law for 
failure to comply with a reporting requirement if the person fails to 
comply with the applicable provisions for electronic reporting.
    (2) Where an electronic document submitted to satisfy a state, 
tribe, or local reporting requirement bears an electronic signature, 
the electronic signature legally binds or obligates the signatory, or 
makes the signatory responsible, to the same extent as the signatory's 
handwritten signature on a paper document submitted to satisfy the same 
reporting requirement.
    (3) Proof that a particular electronic signature device was used to 
create an electronic signature that is included in or logically 
associated with an electronic document submitted to satisfy a state, 
tribe, or local reporting requirement will suffice to establish that 
the individual uniquely entitled to use the device at the time of 
signature did so with the intent to sign the electronic document and 
give it effect.
    (4) Nothing in the authorized program limits the use of electronic 
documents or information derived from electronic documents as evidence 
in enforcement proceedings.

Appendix 1 to Part 3--Priority Reports

------------------------------------------------------------------------
           Category                   Description        40 CFR Citation
------------------------------------------------------------------------
                            Required Reports
------------------------------------------------------------------------
State Implementation Plan.....  Emissions data reports  51.60(c).
                                 for mobile sources.
Excess Emissions and            Excess emissions and    60.7(c),
 Monitoring Performance Report   monitoring              60.7(d).
 Compliance Notification         performance report
 Report.                         detailing the
                                 magnitude of excess
                                 emissions, and
                                 provides the date,
                                 time, and system
                                 status at the time of
                                 the excess emission.
New Source Performance          Semi-annual reports     60.49a(e) & (j)
 Standards Reporting             (quarterly, if report   & (v),
 Requirements.                   is approved for         60.49b(v).
                                 electronic submission
                                 by the permitting
                                 authority) on sulfur
                                 dioxide, nitrous
                                 oxides and
                                 particulate matter
                                 emission (includes
                                 reporting
                                 requirements in
                                 Subparts A through
                                 DDDD).
Semi-annual Operations and      Semi-annual report      60.107(c),
 Corrective Action Reports.      provides information    60.107(d).
                                 on a company's
                                 exceedance of its
                                 sulfur dioxide
                                 emission rate, sulfur
                                 content of the fresh
                                 feed, and the average
                                 percent reduction and
                                 average concentration
                                 of sulfur dioxide.
                                 When emissions data
                                 is unavailable, a
                                 signed statement is
                                 required which
                                 documents the
                                 changes, if any, made
                                 to the emissions
                                 control system that
                                 would impact the
                                 company's compliance
                                 with emission limits.

[[Page 59885]]

 
National Emission Standards     Include such reports    61.11,
 for Hazardous Air Pollutants    as: Annual              61.24(a)(3) &
 Reporting Requirements.         compliance,             (a)(8),
                                 calculation, initial    61.70(c)(1) &
                                 startup, compliance     (c)(2)(v) &
                                 status,                 (c)(3) &
                                 certifications of       (c)(4)(iv),
                                 compliance, waivers     61.94(a) &
                                 from compliance         (b)(9),
                                 certifications,         61.104(a) &
                                 quarterly inspection    (a)(1)(x) &
                                 certifications,         (a)(1)(xi) &
                                 operations, and         (a)(1)(xvi),
                                 operations and          61.138(e) &
                                 process change.         (f),
                                                         61.165(d)(2) &
                                                         (d)(3) & (d)(4)
                                                         & (f)(1) &
                                                         (f)(2) &(f)(3),
                                                         61.177(a)(2) &
                                                         (c)(1) & (c)(2)
                                                         & (c)(3) &
                                                         (e)(1) &
                                                         (e)(3),
                                                         61.186(b)(1) &
                                                         (b)(2) & (b)(3)
                                                         & (c)(1) &
                                                         (f)(1),
                                                         61.247(a)(1) &
                                                         (a)(4) &
                                                         (a)(5)(v) &
                                                         (b)(5) & (d),
                                                         61.254(a)(4),
                                                         61.275(a) & (b)
                                                         & (c),
                                                         61.305(f) &
                                                         (i), 61.357(a)
                                                         & (b) & (c) &
                                                         (d), 63.9(h).
Hazardous Air Pollutants        Reports containing      63.10(d),
 Compliance Report.              results from            63.10(e)(1),
                                 performance test,       63.10(e)(3).
                                 opacity tests, and
                                 visible emissions
                                 tests. Progress
                                 reports; periodic and
                                 immediate startup,
                                 shutdown, and
                                 malfunction reports;
                                 results from
                                 continuous monitoring
                                 system performance
                                 evaluations; excess
                                 emissions and
                                 continuous monitoring
                                 system performance
                                 report; or summary
                                 report.
Notifications and Reports.....  Reports that document   65.5(d),
                                 a facility's initial    65.5(e).
                                 compliance status,
                                 notification of
                                 initial start-up, and
                                 periodic reports
                                 which includes the
                                 startup, shutdown,
                                 and malfunction
                                 reports discussed in
                                 40 CFR 65.6(c).
Continuous Emissions            Quarterly emissions     75.64, 75.65.
 Monitoring.                     monitoring reports
                                 and opacity reports
                                 which document a
                                 facility's excess
                                 emission.
Notice of Fuel or Fuel          Registration of new     79.10, 79.11,
 Additive Registration and       fuels and additives,    79.20, 79.21,
 Health Effects Testing.         and the submission      79.51.
                                 and certification of
                                 health effect data.
Manufacture In-Use and Product  Reports that document   86.1845,
 Line Emissions Testing.         the emissions testing   86.1846,
                                 results generated       86.1847,
                                 from the in-use         90.113,
                                 testing program for     90.1205,
                                 new and in-use          90.704, 91.805,
                                 highway vehicle         91.504, 92.607,
                                 ignition engines; non-  92.508, 92.509.
                                 road spark-ignition
                                 engines; marine spark-
                                 ignition engines; and
                                 locomotives and
                                 locomotive engines.
Industrial and Publicly Owned   Discharge monitoring    122.41(l)(4)(i),
 Treatment Works Reports.        reports for all         403.12(b) & (d)
                                 individual              & (e) & (h).
                                 permittees--including
                                 baseline reports,
                                 pretreatment
                                 standards report,
                                 periodic compliance
                                 reports, and reports
                                 made by significant
                                 industrial users.
-------------------------------
                          Event Driven Notices
------------------------------------------------------------------------
State Implementation Plan.....  Owners report           51.211.
                                 emissions data from
                                 stationary sources.
Report For Initial Performance  Report that provides    60.2200 (initial
 Test.                           the initial             performance
                                 performance test        tests).
                                 results, site-
                                 specific operating
                                 limits, and, if
                                 installed,
                                 information on the
                                 bag leak detection
                                 device used by the
                                 facility.
Emissions Control Report......  Report submitted by     61.153(a)(1),
                                 new sources within 90   61.153(a)(4)(i)
                                 days of set-up which    ,
                                 describes emission      61.153(a)(5)(ii
                                 control equipment       ).
                                 used, processes which
                                 generate asbestos-
                                 containing waste
                                 material, and
                                 disposal information.
State Operating Permits--       Monitoring and          70.6(a)(3)(iii)(
 Permit Content.                 deviation reports       A),
                                 under the State         70.6(a)(3)(iii)
                                 Operating Permit.       (B).
Title V Permits--Permit         Monitoring and          71.6(a)(3)(iii).
 Content.                        deviation reports
                                 under the Federal
                                 Operating Permit.
Annual Export Report..........  Annual report           262.56(a).
                                 summarizing the
                                 amount and type of
                                 hazardous waste
                                 exported.
Exceptions Reports............  Reports submitted by a  262.42, 262.55.
                                 generator when the
                                 generator has not
                                 received confirmation
                                 from the Treatment,
                                 Storage, and Disposal
                                 Facility (TSDF) that
                                 it received the
                                 generator's waste and
                                 when hazardous waste
                                 shipment was received
                                 by the TSDF. For
                                 exports, reports
                                 submitted when the
                                 generator has not
                                 received a copy of
                                 the manifest from the
                                 transporter with
                                 departure date and
                                 place of export
                                 indicated; and
                                 confirmation from the
                                 consignee that the
                                 hazardous waste was
                                 received or when the
                                 hazardous waste is
                                 returned to the U.S.
Contingency Plan                Follow-up reports made  264.56(j),
 Implementation Reports.         to the Agency for all   265.56(j).
                                 incidents noted in
                                 the operating record
                                 which required the
                                 implementation of a
                                 facility's
                                 contingency plan.
Significant Manifest            Report filed by         264.72(b),
 Discrepancy Report.             Treatment, Storage,     265.72(b).
                                 and Disposal
                                 Facilities (TSDF)
                                 within 15 days of
                                 receiving wastes,
                                 when the TSDF is
                                 unable to resolve
                                 manifest
                                 discrepancies with
                                 the generator.
Unmanifested Waste Report.....  Report that documents   264.76, 265.76.
                                 hazardous waste
                                 received by a
                                 Treatment, Storage,
                                 and Disposal Facility
                                 without an
                                 accompanying manifest.
Noncompliance Report..........  An owner/operator       264.1090.
                                 submitted report
                                 which documents
                                 hazardous waste that
                                 was placed in
                                 hazardous waste
                                 management units in
                                 noncompliance with 40
                                 CFR sections
                                 264.1082(c)(1) and
                                 (c)(2); 264.1084(b);
                                 264.1035(c)(4); or
                                 264.1033(d).

[[Page 59886]]

 
Notification--Low Level Mixed   One-time notification   266.345.
 Waste.                          concerning
                                 transportation and
                                 disposal of
                                 conditionally
                                 exempted waste.
Notification--Land Disposal     One-time notification   268.9(d).
 Restrictions.                   and certification
                                 that characteristic
                                 waste is no longer
                                 hazardous.
Underground Storage Tank        Underground Storage     280.22.
 Notification.                   Tank system
                                 notifications
                                 concerning design,
                                 construction, and
                                 installation. As well
                                 as when systems are
                                 being placed in
                                 operation. (EPA Form
                                 7530-1 or state
                                 version.).
Free Product Removal Report     Report written and      280.64, 280.65.
 and Subsequent Investigation    submitted within 45
 Report.                         days after confirming
                                 a free product
                                 release, including
                                 information on the
                                 release and recovery
                                 methods used for the
                                 free product, and
                                 when test indicate
                                 presence of free
                                 product, response
                                 measures.
Manufacture or Import           Premanufacture          720.102, 721.25.
 Premanufacture Notification.    notification of
                                 intent to begin
                                 manufacturing,
                                 importing, or
                                 processing chemicals
                                 identified in Subpart
                                 E for significant new
                                 use (forms 7710-56
                                 and 7710-25).
-------------------------------
                         Permit Applications \1\
------------------------------------------------------------------------
State Implementation Plan.....  Information describing  52.21(n).
                                 the source, its
                                 construction
                                 schedule, and the
                                 planned continuous
                                 emissions reductions
                                 system.
State Operating Permits.......  Reports, notices, or    70.6(c)(1).
                                 other written
                                 submissions required
                                 by a State Operating
                                 Permit.
Title V Permits--Permit         Reports, notices, or    71.6(c)(1),
 Content.                        other written           71.25(c)(1).
                                 submissions required
                                 by a Title V
                                 Operating Permit.
Title V Permits...............  Specific criteria for   71.7(e(2)(ii)(c)
                                 permit modifications    .
                                 and or revisions,
                                 including a
                                 certification
                                 statement by a
                                 responsible official.
Reclaimer Certification.......  Certification made by   82.164.
                                 a reclaimer that the
                                 refrigerant was
                                 reprocessed according
                                 to specifications and
                                 that no more than
                                 1.5% of the
                                 refrigerant was
                                 released during the
                                 reclamation.
Application for Certification   Control of Emissions    86.007-21 (heavy
 and Statement of Compliance.    for New and In-Use      duty), 1844-01
                                 Highway Vehicles and    (light duty).
                                 Engines statement of
                                 compliance made by
                                 manufacturer,
                                 attesting that the
                                 engine family
                                 complies with
                                 standards for new and
                                 in-use highway
                                 vehicles and engines.
Application for Certification.  Application made by     89.115, 90.107,
                                 engine manufacturer     91.107, 92.203,
                                 to obtain certificate   94.203.
                                 of conformity.
National Pollutant Discharge    National Pollutant      122.21.
 Elimination System.             Discharge Elimination
                                 System (NPDES)
                                 Permits and Renewals
                                 (includes individual
                                 permit applications,
                                 NPDES General Form 1,
                                 and NPDES Forms 2A-F,
                                 and 2S).
Resource Conservation and       Signatures for permit   270.11, 270.42.
 Recovery Act Permit             applications and
 Applications and                reports; submission
 Modifications.                  of permit
                                 modifications. (This
                                 category excludes
                                 Class I permit
                                 modifications (40 CFR
                                 270.42, Appendix I)
                                 that do not require
                                 prior approval).
-------------------------------
             Certifications of Compliance/Non-Applicability
------------------------------------------------------------------------
State Implementation Plan       State implementation    51.212(c),
 Requirements.                   plan certifications     51.214(e).
                                 for testing,
                                 inspection,
                                 enforcement, and
                                 continuous emissions
                                 monitoring.
Certification Statement.......  Chemical Accident       68.185.
                                 Prevention
                                 Provisions--Risk
                                 Management Plan
                                 certification
                                 statements.
Title V Permits...............  Federal compliance      70.5(c)(9),
                                 certifications and      70.5(d),
                                 permit applications.    70.6(c)(5).
State Operating Permits.......  State compliance        71.5(c)(9),
                                 certifications and      71.5(d),
                                 permit applications.    71.24(f).
Annual and Other Compliance     Annual compliance       72.90.
 Certification Reports.          certification report
                                 and is submitted by
                                 units subject to acid
                                 rain emissions
                                 limitations.
Annual Compliance               Annual compliance       74.43.
 Certification Report, Opt-In    certification report
 Report, and Confirmation        which is submitted in
 Report.                         lieu of annual
                                 compliance
                                 certification report
                                 listed in Subpart I
                                 of Part 72.
Quarterly Reports and           Continuous Emission     75.73.
 Compliance Certifications.      Monitoring
                                 certifications,
                                 monitoring plans, and
                                 quarterly reports for
                                 NOX emissions.
Certification Letters Recovery  Protection of           79.4, 80.161,
 and Recycling Equipment,        Stratospheric Ozone:    82.162, 82.42.
 Motor Vehicle Air               Recycling & Emissions
 Conditioners Recycling          Reduction.
 Program, Detergent Package.     Acquisition of
                                 equipment for
                                 recovery or recycling
                                 made by auto repair
                                 service technician
                                 and Fuels and Fuel
                                 Additives Detergent
                                 additive
                                 certification.
Response Plan Cover Sheet.....  Oil Pollution           112 (Appendix
                                 Prevention              f).
                                 certification to the
                                 truth and accuracy of
                                 information.
Closure Report................  Report which documents  146.71.
                                 that closure was in
                                 accordance with
                                 closure plan and/or
                                 details difference
                                 between actual
                                 closure and the
                                 procedures outlined
                                 in the closure plan.
Certification of Closure and    Certification that      264.115,
 Post Closure Care, Post-        Treatment, Storage,     264.119,
 Closure Notices.                and Disposal            264.119(b)(2),
                                 Facilities (TSDF) are   264.120,
                                 closed in accordance    265.115,
                                 with approved closure   265.119(b)(2),
                                 plan or post-closure    265.120,
                                 plan.                   265.19.
Certification of Testing Lab    Certification that the  270.63.
 Analysis.                       testing and/or lab
                                 analyses required for
                                 the treatment
                                 demonstration phase
                                 of a two-phase permit
                                 was conducted.

[[Page 59887]]

 
Periodic Certification........  Certification that      437.41(b).
                                 facility is operating
                                 its system to provide
                                 equivalent treatment
                                 as in initial
                                 certification.
------------------------------------------------------------------------
\1\ Included within each permit application category, though sometimes
  not listed, are the permits submitted to run/operate/maintain
  facilities and/or equipment/products under EPA or authorized programs.

PART 9--OMB APPROVALS UNDER THE PAPERWORK REDUCTION ACT

0
1. The authority citation for part 9 continues to read as follows:

    Authority: 7 U.S.C. 135 et seq., 136-136y; 15 U.S.C. 2001, 2003, 
2005, 2006, 2601-2671; 21 U.S.C. 331j, 346a, 31 U.S.C. 9701; 33 
U.S.C. 125l et seq., 1311, 1313d, 1314, 1318, 1321, 1326, 1330, 
1342, 1344, 1345 (d) and (e), 1361; E.O. 11735, 38 FR 21243, 3 CFR, 
1971-1975 Comp. p. 973; 42 U.S.C. 241, 242b, 243, 246, 300f, 300g, 
300g-1, 300g-2, 300g-3, 300g-4, 300g-5, 300g-6, 300j-1, 300j-2, 
300j-3, 300j-4, 300j-9, 1857 et seq., 6901-6992k, 7401-7671q, 7542, 
9601-9657, 11023, 11048.

0
2. Section 9.1 is amended by adding a new entry in numerical order for 
part 3 to read as follows:


Sec.  9.1  OMB approvals under the Paperwork Reduction Act.

* * * * *

------------------------------------------------------------------------
                                                                 OMB
                      40 CFR citation                        Control No.
------------------------------------------------------------------------
 
                                * * * * *
------------------------------------------------------------
                    Cross-Media Electronic Reporting
------------------------------------------------------------------------
Part 3.....................................................    2025-0003
------------------------------------------------------------------------

* * * * *

PART 51--REQUIREMENTS FOR PREPARATION, ADOPTION, AND SUBMITTAL OF 
IMPLEMENTATION PLANS

0
1. The authority citation for part 51 continues to read as follows:

    Authority: 23 U.S.C. 101; 42 U.S.C. 7401-7671q.


0
2. Section 51.286 is added to Subpart O to read as follows:


Sec.  51.286  Electronic reporting.

    States that wish to receive electronic documents must revise the 
State Implementation Plan to satisfy the requirements of 40 CFR Part 
3--(Electronic reporting).

PART 60--STANDARDS OF PERFORMANCE FOR NEW STATIONARY SOURCES

0
1. The authority citation for part 60 continues to read as follows:

    Authority: 42 U.S.C. 7401-7601.


0
2. Section 60.25(b)(1) is amended by adding a sentence to the end of 
the paragraph to read as follows:


Sec.  60.25  Emission inventories, source surveillance, reports.

* * * * *
    (b)(1) * * * Submission of electronic documents shall comply with 
the requirements of 40 CFR part 3--(Electronic reporting).
* * * * *

PART 63--NATIONAL EMISSION STANDARDS FOR HAZARDOUS AIR POLLUTANTS 
FOR SOURCE CATEGORIES

0
1. The authority citation for part 63 continues to read as follows:

    Authority: 42 U.S.C. 7401 et seq.


0
2. Section 63.91 is amended by adding a new paragraph (d)(5)to read as 
follows:


Sec.  63.91  Criteria for straight delegation and criteria common to 
all approved options.

* * * * *
    (d) * * *
    (5) Electronic documents. Submission of electronic documents shall 
comply with the requirements of 40 CFR part 3--(Electronic reporting).
* * * * *

PART 69--SPECIAL EXEMPTIONS FROM REQUIREMENTS OF THE CLEAN AIR ACT

0
1. The authority citation for part 69 continues to read as follows:

    Authority: 42 U.S.C. 7545(c), (g) and (i), and 7625-1.


0
2. Section 69.13 is amended by adding a new paragraph (b)(1)(v) to read 
as follows:


Sec.  69.13  Title V conditional exemption.

* * * * *
    (b) * * *
    (1) * * *
    (v) If the program chooses to accept electronic documents it must 
satisfy the requirements of 40 CFR Part 3--(Electronic reporting).
* * * * *

0
3. Section 69.22 is amended by adding a new paragraph (b)(1)(v) to read 
as follows:


Sec.  69.22  Title V conditional exemption.

* * * * *
    (b) * * *
    (1) * * *
    (v) If the program chooses to accept electronic documents it must 
satisfy the requirements of 40 CFR Part 3--(Electronic reporting).
* * * * *

0
4. Section 69.32 is amended by adding a new paragraph (b)(1)(v) to read 
as follows:


Sec.  69.32  Title V conditional exemption.

* * * * *
    (b) * * *
    (1) * * *
    (v) If the program chooses to accept electronic documents it must 
satisfy the requirements of 40 CFR Part 3--(Electronic reporting).
* * * * *

PART 70--STATE OPERATING PERMIT PROGRAMS

0
1. The authority citation for part 70 continues to read as follows:

    Authority: 42 U.S.C. 7401, et seq.


0
2. Section 70.1 is amended by adding a new paragraph (f) to read as 
follows:


Sec.  70.1  Program overview.

* * * * *
    (f) States that choose to receive electronic documents must satisfy 
the requirements of 40 CFR Part 3--(Electronic reporting) in their 
program.

PART 71--FEDERAL OPERATING PERMIT PROGRAMS

0
1. The authority citation for part 71 continues to read as follows:

    Authority: 42 U.S.C. 7401, et seq.


0
2. Section 71.10 is amended by adding a new sentence to the end of 
paragraph (a) to read as follows:


Sec.  71.10  Delegation of part 71 program.

    (a) * * * Delegate agencies that choose to receive electronic 
documents as part of their delegated program must satisfy the 
requirements of 40 CFR Part 3--(Electronic reporting).
* * * * *

PART 123--STATE PROGRAM REQUIREMENTS

0
1. The authority citation for part 123 continues to read as follows:

    Authority: Clean Water Act, 33 U.S.C. 1251 et seq.


[[Page 59888]]



0
2. Section 123.25 is amended by revising paragraphs (a)(44) and 
(a)(45), adding the phrase ``Except for paragraph (a)(46) of this 
section,'' at the beginning of the Note to paragraph (a), and adding a 
new paragraph (a)(46) to read as follows:


Sec.  123.25  Requirements for permitting.

    (a) * * *
    (44) Sec.  122.35 (As an operator of a regulated small MS4, may I 
share the responsibility to implement the minimum control measures with 
other entities?);
    (45) Sec.  122.36 (As an operator of a regulated small MS4, what 
happens if I don't comply with the application or permit requirements 
in Sec. Sec.  122.33 through 122.35?); and
    (46) For states that wish to receive electronic documents, 40 CFR 
Part 3--(Electronic reporting).
* * * * *

PART 142--NATIONAL PRIMARY DRINKING WATER REGULATIONS 
IMPLEMENTATION

0
1. The authority citation for part 142 continues to read as follows:

    Authority: 42 U.S.C. 300f, 300g-1, 300g-2, 300g-3, 300g-4, 300g-
5, 300g-6, 300j-4, 300j-9, and 300j-11.


0
2. Section 142.10 is amended by redesignating paragraph (g) as 
paragraph (h) and by adding a new paragraph (g) to read as follows:


Sec.  142.10  Requirements for a determination of primary enforcement 
responsibility.

* * * * *
    (g) Has adopted regulations consistent with 40 CFR Part 3--
(Electronic reporting) if the state receives electronic documents.
* * * * *

PART 145--REQUIREMENTS FOR STATE PROGRAMS

0
1. The authority citation for part 145 continues to read as follows:

    Authority: 42 U.S.C. 300f et seq.


0
2. Section 145.11 is amended by revising paragraphs (a)(30), (a)(31), 
(a)(32), and adding paragraph (a)(33) to read as follows:


Sec.  145.11  Requirements for permitting.

    (a) * * *
    (30) Section 124.12(a)--(Public hearings);
    (31) Section 124.17 (a) and (c)--(Response to comments);
    (32) Section 144.88--(What are the additional requirements?); and
    (33) For states that wish to receive electronic documents, 40 CFR 
Part 3--(Electronic reporting).
* * * * *

PART 162--STATE REGISTRATION OF PESTICIDE PRODUCTS

0
1. The authority citation for part 162 continues to read as follows:

    Authority: 7 U.S.C. 136v, 136w.


0
2. Section 162.153 is amended by adding a paragraph (a)(6) to read as 
follows:


Sec.  162.153  State registration procedures.

    (a) * * *
    (6) Electronic Reporting under State Registration of Pesticide 
Products for Special Local Needs. States that choose to receive 
electronic documents under the regulations pertaining to state 
registration of pesticides to meet special local needs, must ensure 
that the requirements of 40 CFR Part 3--(Electronic reporting) are 
satisfied by their state procedures for such registrations.
* * * * *

PART 233--404 STATE PROGRAM REGULATIONS

0
1. The authority citation for part 233 continues to read as follows:

    Authority: 33 U.S.C. 1251 et seq.


0
2. A new Sec.  233.39 is added to Subpart D to read as follows:


Sec.  233.39  Electronic reporting.

    States that choose to receive electronic documents must satisfy the 
requirements of 40 CFR Part 3--(Electronic reporting) in their state 
program.

PART 257--CRITERIA FOR CLASSIFICATION OF SOLID WASTE DISPOSAL 
FACILITIES AND PRACTICES

0
1. The authority citation for part 257 continues to read as follows:

    Authority: 42 U.S.C. 6907(a)(3), 6912(a)(1), 6944(a) and 
6949(c), 33 U.S.C. 1345(d) and (e).


0
2. Section 257.30 is amended by adding a new paragraph (d) to read as 
follows:


Sec.  257.30  Recordkeeping requirements.

* * * * *
    (d) The Director of an approved state program may receive 
electronic documents only if the state program includes the 
requirements of 40 CFR Part 3--(Electronic reporting).

PART 258--CRITERIA FOR MUNICIPAL SOLID WASTE LANDFILLS

0
1. The authority citation for part 258 continues to read as follows:

    Authority: 33 U.S.C. 1345(d) and (e); 42 U.S.C. 6902(a), 6907, 
6912(a), 6944, 6945(c) and 6949a(c).


0
2. Section 258.29 is amended by adding a new paragraph (d) to read as 
follows:


Sec.  258.29  Recordkeeping requirements.

* * * * *
    (d) The Director of an approved state program may receive 
electronic documents only if the state program includes the 
requirements of 40 CFR Part 3--(Electronic reporting).

PART 271--REQUIREMENTS FOR AUTHORIZATION OF STATE HAZARDOUS WASTE 
PROGRAMS

0
1. The authority citation for part 271 continues to read as follows:

    Authority: 42 U.S.C. 6905, 6912 and 6926.


0
2. Section 271.10 is amended by revising paragraph (b) to read as 
follows:


Sec.  271.10  Requirements for generators of hazardous waste.

* * * * *
    (b) The State shall have authority to require and shall require all 
generators to comply with reporting and recordkeeping requirements 
equivalent to those under 40 CFR 262.40 and 262.41. States must require 
that generators keep these records at least 3 years. States that choose 
to receive electronic documents must include the requirements of 40 CFR 
Part 3--(Electronic reporting) in their Program (except that states 
that choose to receive electronic manifests and/or permit the use of 
electronic manifests must comply with any applicable requirements for 
e-manifest in this section of this section).
* * * * *

0
3. Section 271.11 is amended by revising paragraph (b) to read as 
follows:


Sec.  271.11  Requirements for transporters of hazardous waste.

* * * * *
    (b) The State shall have authority to require and shall require all 
transporters to comply with reporting and recordkeeping requirements 
equivalent to those under 40 CFR 263.22. States must require that 
transporters keep these records at least 3 years. States that choose to 
receive electronic documents must include the requirements of 40 CFR 
Part 3--(Electronic reporting) in their Program (except that states 
that choose to receive electronic manifests

[[Page 59889]]

and/or permit the use of electronic manifests must comply with any 
applicable requirements for e-manifest in this section of this 
section).
* * * * *

0
4. Section 271.12 is amended by revising paragraph (h) to read as 
follows:


Sec.  271.12  Requirements for hazardous waste management facilities.

* * * * *
    (h) Inspections, monitoring, recordkeeping, and reporting. States 
that choose to receive electronic documents must include the 
requirements of 40 CFR Part 3--(Electronic reporting) in their Program 
(except that states that choose to receive electronic manifests and/or 
permit the use of electronic manifests must comply with paragraph (i) 
of this section);
* * * * *

PART 281--APPROVAL OF STATE UNDERGROUND STORAGE TANK PROGRAMS

0
1. The authority citation for part 281 continues to read as follows:

    Authority: 42 U.S.C. 6912, 6991 (c), (d), (e), (g).


0
2. Section 281.40 is amended by revising paragraph (d) to read as 
follows:


Sec.  281.40  Requirements for compliance monitoring program and 
authority.

* * * * *
    (d) State programs must have procedures for receipt, evaluation, 
retention and investigation of records and reports required of owners 
or operators and must provide for enforcement of failure to submit 
these records and reports. States that choose to receive electronic 
documents must include the requirements of 40 CFR Part 3--(Electronic 
reporting) in their state program.
* * * * *

PART 403--GENERAL PRETREATMENT REGULATIONS FOR EXISTING AND NEW 
SOURCES OF POLLUTION

0
1. The authority citation for part 403 continues to read as follows:

    Authority: 33 U.S.C. 1251 et seq.


0
2. Section 403.8 is amended by adding a new paragraph (g) to read as 
follows:


Sec.  403.8  Pretreatment Program Requirements: Development and 
Implementation by POTW.

* * * * *
    (g) A POTW that chooses to receive electronic documents must 
satisfy the requirements of 40 CFR Part 3--(Electronic reporting).

0
3. Section 403.12 is amended by adding a new paragraph (r) to read as 
follows:


Sec.  403.12  Reporting requirements for POTW's and industrial users.

* * * * *
    (r) The Control Authority that chooses to receive electronic 
documents must satisfy the requirements of 40 CFR Part 3--(Electronic 
reporting).

PART 501--STATE SLUDGE MANAGEMENT PROGRAM REGULATIONS

0
1. The authority citation for part 501 continues to read as follows:

    Authority: 33 U.S.C. 1251 et seq.


0
2. Section 501.15 is amended by adding a new paragraph (a)(4) to read 
as follows:


Sec.  501.15  Requirements for permitting.

    (a) * * *
    (4) Information requirements: All treatment works treating domestic 
sewage shall submit to the Director within the time frames established 
in paragraph (d)(1)(ii) of this section the information listed in 
paragraphs (a)(4)(i) through (xii) of this section. The Director of an 
approved state program that chooses to receive electronic documents 
must satisfy the requirements of 40 CFR part 3--(Electronic reporting).
* * * * *

PART 745--LEAD-BASED PAINT POISONING PREVENTION IN CERTAIN 
RESIDENTIAL STRUCTURES

0
1. The authority citation for part 745 continues to read as follows:

    Authority: 15 U.S.C. 2605, 2607, 2681-2692 and 42 U.S.C. 4852d.


0
2. Section 745.327 is amended by adding a new paragraph (f) to read as 
follows:


Sec.  745.327  State or Indian Tribal lead-based paint compliance and 
enforcement programs.

* * * * *
    (f) Electronic reporting under State or Indian Tribe programs. 
States and tribes that choose to receive electronic documents under the 
authorized state or Indian tribe lead-based paint program, must ensure 
that the requirements of 40 CFR part 3--(Electronic reporting) are 
satisfied in their lead-based paint program.

PART 763--ASBESTOS

0
1. The authority citation for part 763 continues to read as follows:

    Authority: 15 U.S.C. 2605, 2607(c), 2643, and 2646.


0
2. Section 763.98 is amended by revising paragraphs (a)(1), (b)(3), and 
(d)(3) to read as follows:


Sec.  763.98  Waiver; delegation to state.

    (a) General. (1) Upon request from a state Governor and after 
notice and comment and an opportunity for a public hearing in 
accordance with paragraphs (b) and (c) of this section, EPA may waive 
some or all of the requirements of this subpart E if the state has 
established and is implementing or intends to implement a program of 
asbestos inspection and management that contains requirements that are 
at least as stringent as the requirements of this subpart. In addition, 
if the state chooses to receive electronic documents, the state program 
must include, at a minimum, the requirements of 40 CFR part 3--
(Electronic reporting).
* * * * *
    (b) * * *
    (3) Detailed reasons, supporting papers, and the rationale for 
concluding that the state's asbestos inspection and management program 
provisions for which the request is made are at least as stringent as 
the requirements of Subpart E of this part, and that, if the state 
chooses to receive electronic documents, the state program includes, at 
a minimum, the requirements of 40 CFR part 3--(Electronic reporting).
* * * * *
    (d) * * *
    (3) The state has an enforcement mechanism to allow it to implement 
the program described in the waiver request and any electronic 
reporting requirements are at least as stringent as 40 CFR part 3--
(Electronic reporting).
* * * * *

0
3. Appendix C to subpart E of part 763 is amended by adding paragraph 
(I) to section I to read as follows:

Appendix C to Subpart E of Part 763--Asbestos Model Accreditation Plan

I. Asbestos Model Accreditation Plan for States

* * * * *
    (I) Electronic Reporting.
    States that choose to receive electronic documents must include, 
at a minimum, the requirements of 40 CFR Part 3--(Electronic 
reporting) in their programs.
* * * * *
[FR Doc. 05-19601 Filed 10-12-05; 8:45 am]
BILLING CODE 6560-50-P