MEMORANDUM

TO:		Public Record for the NPDES Electronic Reporting Rule
		EPA Docket Number EPA-HQ-OECA-2009-0274 (www.regulations.gov)	

FROM:	Carey A. Johnston, P.E.
            USEPA/OECA/OC
            ph: (202) 566 1014
            johnston.carey@epa.gov

            Marco Kushner
            Honors Law Clerk USEPA/OECA/ETDD

DATE:		14 April 2014

--------------------------------------------------------------------------------
SUBJECT:	Potential Alternative Options for Submission of Regulatory Reports Identified in the NPDES Electronic Reporting Rule
--------------------------------------------------------------------------------


General Overview

      EPA is proposing a regulation (The NPDES Electronic Reporting Rule at 40 CFR Parts 122, 123, 127, 403, 501, and 503, "eRule") that would require electronic reporting for most current paper-based NPDES reports. Data systems receiving electronic reports from programs that states, tribes, or local governments are authorized to manage must meet Cross Media Electronic Reporting Regulation (CROMERR) standards in accordance with Code of Federal Regulations (CFR) Title 40 Part 3. CROMERR is intended to reduce the cost and burden of regulatory reporting by encouraging electronic reporting while maintaining the same level of corporate and individual responsibility as paper reporting.
      
      Some state comments to the eRule suggest that implementation as proposed will not achieve the cost savings sought, will cause increased compliance costs on those least able to bear them, and will increase the burden on states who actually implement most of the NPDES program. A comment from North Dakota Department of Health, Water Quality Division, asserts that rigid CROMERR requirements are unnecessary, particularly as they pertain to non-priority reports such as Notices of Intent. The North Dakota comment suggests the possibility of using other technologies such as, 2-dimensional barcodes or quick response codes (QR codes) and Optical Character Recognition (OCR) as a less burdensome alternative to CROMERR's electronic signature and authentication procedures.  The purpose of this memo is to explore possible ways of incorporating these technologies in the submission process for non-priority reports. Ideally, the submission process will obviate the need for a CROMERR electronic signature on reports that are submitted infrequently.
      
1. 	CROMERR Requirements for Non-Priority Reports 
      
      The CROMERR requirements for electronic signatures and identity proofing are different for priority and non-priority reports. Priority reports are identified by the EPA as reports that are likely to be frequently material in enforcement litigation. A list of these reports can be found under Appendix 1 to Part 3. 
      
      As with priority reports, the permitting authority must determine the identity of the individual registering to sign non-priority reports by collecting and maintaining information sufficient to prove the identity of that individual with legal certainty. In the case of non-priority reports, however, this evidence does not need to be collected prior to activation of the associated signature credentials. In addition, the rule allows greater flexibility in the forms of proof that may be used as evidence of identity, provided that they collectively meet the same evidentiary standard: proof beyond a reasonable doubt. 
      
      Appendix 1 to Part 3 only identifies priority reports. Priority reports include NPDES permit renewals and applications (including individual permit applications, NPDES general Form 1, and NPDES Forms 2A-F, and 2s). The following table identifies non-priority reports identified for electronic reporting in the eRule. 
      
General Permit Reports (NOI, NOT, NECs, LEWs)
                              Non-Priority Report
                              40 CFR Part 122.28
Biosolids Annual Program Reports
                              Non-Priority Report
                                40 CFR Part 503
CAFO Annual Program Reports
                              Non-Priority Report
                           40 CFR Part 122.42(e)(4)
MS4 Program Reports
                              Non-Priority Report
                      40 CFR Part 122.34(g)(3), 122.42(c)
Pretreatment Program Annual Reports 
                              Non-Priority Report
                             40 CFR Part 403.12(i)
CWA 316(b) Annual Reports
                              Non-Priority Report
                        40 CFR 125 Subparts I, J and N
      
      Some comments to the proposed Electronic Reporting Rule suggest that the required registration and identify-proofing process is too burdensome for NOI submission. There are many entities that may only submit one NOI or only submit an NOI once every few years. These commenters noted that they see it as a burden to remember their registration information for a process that they only use infrequently.
       
      The next part of this memo explores possible technologies that may allow operators to comply with the eRule with the use of CROMERR approved electronic reporting tools. 
      
2. 	Possible Technologies for Use with Non-Priority Reports  
      A. Use QR Codes to Cross-Reference Electronic Report with Separate Paper Signature.
      In their comment to the eRule, North Dakota Department of Health, WQD suggests that EPA allow NOIs to be submitted electronically followed by a hard copy and wet-ink signature. The wet-ink signature would allow persons submitting NOIs to avoid a registration process that involves real-time, online identity-proofing while the electronic submission will ease the burden of data management for the state agency. 
      Currently there are EPA and state programs that take electronic submissions where the requirements for a signed certification statement are met with a follow-on paper submission with handwritten signatures. See 70 FR 59858. The CROMERR final rule specifically addresses these "follow on paper" certifications. Section 3.10(b) only allows handwritten signatures to substitute for electronic signatures on submissions to EPA where "EPA announces special provisions" for this purpose. Likewise, Section 3.2000(a)(2) directs states to require electronic signatures unless the EPA has approved the state program to accept a separate paper signature submission.
	These "special provisions" would allow follow-on paper signature submission only if it were reliably linked or cross-referenced with the associated electronic document. See 70 FR 59858. According to the EPA, the linking or cross-referencing is necessary in part to ensure that the agency can always determine which signature submissions belong with which electronic documents. See 70 FR 59858.  Paper signature submissions must also provide sufficient evidence that the signatory intended to certify to or attest to the content of the electronic document as this content is recorded in the copy of record for the submission. § 3.2000(a)(2).  There are various approaches to cross-referencing or linking that would meet these needs, most of which involve the inclusion of extra data elements in the signature submission that reference the associated electronic document. Such data elements might include summary data from the electronic document, the date and time of the electronic submission, or even the calculated hash value of the electronic document. The EPA has stated that it may use these approaches and "other alternatives" if the decision was made to provide for follow-on paper signatures. See 70 FR 59848. 

	QR codes should be considered as an alternative method of cross-referencing and linking the electronic document and paper signature. A QR code is a trademark for a two-dimensional barcode. It was first used in the automotive industry in Japan. It was designed to allow high-speed component scanning to track vehicles during manufacture. A QR code uses four standardized encoding modes (numeric, alphanumeric, byte/binary, and Japanese characters) to store data efficiently. 
      QR codes are now used in a much broader context, including both commercial tracking application and convenience-oriented applications aimed at mobile phone users. The QR code is also being used for authentication and to ensure security. This is primarily seen in the context of code payment and website logins. QR codes can be used to store bank account information or credit card information.
       When an operator submits an electronic report, various kinds of data can be converted into a QR Code and affixed to both the electronic and paper document. This data could include the time and date of submission or unique identifying information about the operator. Depending on the number of alphanumeric characters in the report and the size of the QR Code, it may be possible to encode the report in its entirety. The largest QR Code has a data capacity of 7,089 numeric and 4,926 alphanumeric characters. Certain shorter length non-priority reports, such as a one or two page NOI, may be able to fit in these parameters. If so, the state could scan the paper report's QR Code to open the electronic version of the same report.
       
      It is possible to encode information in the QR Code using a cryptographic hashing function in order to verify the identity of the operator and to determine whether document tampering occurred.

      Figure 1: Schematic of Using the QR Code Option for eRule Reporting

                                       

                                       
                                        
	Using this technology, the state data system can ensure that the paper signature is linked to the appropriate electronic submission. 

B. 	Avoid CROMERR Requirements by Using Optical Character Recognition (OCR) and Intelligent Character Recognition (ICR) Software to Receive Handwritten Reports. 
	
	Optical Character Recognition (OCR) is the mechanical or electronic conversion of scanned or photographed images of type written text into computer-readable text. Recognition of Latin-script, typewritten text is still not 100 percent accurate even where clear imaging is available although most OCR software claims 99 percent accuracy. However, something close to total accuracy might be achievable by human review or redundant entries. 
      
      Intelligent character recognition (ICR) is an advanced OCR handwriting recognition system that allows fonts and different styles of handwriting to be learned by a computer during processing to improve accuracy and recognition levels. Most ICR software has a self-learning system referred to as a neural network, which automatically updates the recognition database for new handwriting patterns. ICR extends the usefulness of scanning devices for the purpose of document processing, from printed character recognition to hand-written matter recognition. Hand-written data can be automatically converted to digital files, avoiding laborious manual keying and can be more accurate than traditional human data entry.
      
      ICR software can achieve more than 97 percent accuracy. Some ICR software companies (e.g. Captricity) are relying on human workers to verify and correct the results of the document conversion. Using this process, companies claim they can achieve better than 99 percent accuracy. The FDA is currently using this approach to manage a significant paper backlog for critical adverse drug reaction forms. 

    Figure 2: Schematic of Using the OCR or ICR Option for eRule Reporting


      
      Data systems could receive reports as standardized forms completed and signed by the operator in writing. CROMERR would not apply to this process because the reports are not received electronically. This process, however, would allow the state entity to save time on data entry and management. The state entity would scan the paper report and signature which would then, using OCR and ICR software, be automatically converted to a digital format and entered into a database. One benefit of this process is that it would allow persons without broadband access to submit their reports in a format that will ease the burden of data management for receiving entity.



