john a. coates, p.e., administrator wastewater compliance evaluation section,
DESCRIPTION
Florida’s Electronic Discharge Monitoring Report (EDMR) System Preserving Data Credibility. John A. Coates, P.E., Administrator Wastewater Compliance Evaluation Section, Office of Wastewater Management. Florida Department of Environmental Protection. Present paper based system. - PowerPoint PPT PresentationTRANSCRIPT
John A. Coates, P.E., Administrator
Wastewater Compliance Evaluation Section,Office of Wastewater Management
Florida Department of Environmental Protection
Florida’s Electronic Discharge Monitoring Report (EDMR) System
Preserving Data Credibility
Present paper based system...
~4,500 individually permitted wastewater facilities
3 parts to DMRs Part A, Summary statisticsPart B, Daily ValuesPart D, Groundwater wells
... can be burdensome!
Implementation Approach
Specify Functionality
balance technology vs. administrative process
reduce unforeseen risks by keeping control within system
build in administrative controls
enfoTech & Consulting, Inc. www.enfoTech.com
System Description... Web-enabled “Thin Client” application
X.12 EDI protocol text file
Data encryption during Internet submission
Registered Users with access control via user names and passwords
PIN-based electronic signature for submitters
Registration Process... “Who are you?”
Existing legacy system tracks permittees & “Authorized Representatives”
Notarized Application Forms for:
Permittee request for permit modification & designation of “Viewers” or “Certifiers”
Electronic Signature Agreement for Certifiers
Registration Process... “PINs & Electronic Signatures”
“Electronic Signature Act of 1996,” in Part II, Chapter 282, F.S. (§ 282.70-282.75, F.S.)
Confidentiality & PIN compromise issues addressed in ESA and minor permit revision
Preliminary (non functional) PIN issued via certified mail in confidential envelope
Certifiers obtain Functioning PIN via system (being built)
EDMR Status“Ready, Set, Verify, Go”
Initial Trial Status
Review period during which paper DMRs are submitted for “verifying” file compatibility & accuracy
Information is not automatically transferred to legacy system
Functions for suspension, etc.
Manual status changes and historical tracking
Automatic after repeated failures in password or PIN entry
Submission Process“Mail that Report”
SSL encrypted connection
StepsFile selectionPIN entry (& verification)Required Check for Certification StatementSubmit
Enhanced Certification Statement
“Return Receipt” submittal response (being added)
EDMR Submission Logs“While you were submitting...”
EDMR Submission Log
user name, password, PIN
submission date/time for File Selection, Submit, Received, & Acknowledgement Sent.
IP address captured and stored
Checksum
Copy of Record“While you were submitting...”
Copy of Record
X.12 EDMR file
self-monitoring data
limits/requirements
Submission Log (with forensic information)
EDMR Storage and Access“The EDMR Afterlife...”
X.12 EDMR file stored as Binary Large Object in Oracle 8i
Processed for online viewing and data transfer
EDMR Status/error messages and human readable views/download provided
Revisions allowed, but, each submission maintains records of revisions
Database Functionality... “enhancing credibility”
PIN & Password instances encrypted
Database constraints set to “Insert Only” for Key fields
submission file (X.12)
password, PIN, & checksum
rest of Submission Log
Audit Trail feature
records any changes to selected tables/fields
Fundamentals for Credible and Enforceable Data
Authentication
Report Integrity
Nonrepudiation
AuthenticationIdentifying the SubmitterReliance on Notary laws
Person must be permittee or authorized representative
ESA and Permit confidentiality requirements
Functional PIN issuance procedure
preface to certification statement
forensic data (e.g., IP address)
Report IntegritySecuring the DataDuring Transmission
SSL and TCP/IP protection during transmission
Capturing Checksum as received
After Receipt
general system security
Department roles
database design (e.g., Insert Only and Audit Trail features)
Permanent Copy of Record
NonrepudiationVerifying Intent
Design of Submission Steps
Proximity of PIN to Certification statement
Certification statement language
System requires active “check” of Certification statement for each submission to demonstrate intent to be bound by the content of the data
“Data” file includes data & limits
Demonstrating Credibility “The Persuasive Expert”
Well documented system design and operating procedures
Generation of Log Reports
System Access
Electronic Signature
Submission
Record Integrity Report
reproduces copy of record
compares original checksum with current
provides related Audit Trail records
Summary
Credible Data ?
Administrative (procedural) & technological solutions
reduce unforeseen risks
Reasonable to build, implement & maintain
Contacts or questions