Domestic Mail Manual and postage meters: based indicia; production, distribution, and use,

[Federal Register: October 2, 2000 (Volume 65, Number 191)]

[Proposed Rules]

[Page 58682-58698]

From the Federal Register Online via GPO Access [wais.access.gpo.gov]

[DOCID:fr02oc00-23]

POSTAL SERVICE

39 CFR Parts 111 and 502

Production, Distribution, and Use of Postal Security Devices and Information-Based Indicia

AGENCY: Postal Service.

ACTION: Proposed rule.

SUMMARY: The Postal Service is proposing to add new sections to the Domestic Mail Manual (DMM) and to title 39, Code of Federal Regulations (CFR), to reflect policies and regulations pertaining to all postage evidencing systems that generate information-based indicia (IBI). We originally published policies and regulations for public review and comment in the March 28, 1997, Federal Register (62 FR 14833). In the September 2, 1998, Federal Register (63 FR 46719) we published a revision of those proposed policies and regulations which included changes made in response to the comments received from the public.

This publication of proposed policies and regulations includes extensive changes. We based the changes since the 1998 publication on public comments and on the experience we gained by testing and implementing the first postage evidencing systems to generate information-based indicia (IBI). One significant proposed change is the establishment by the Postal Service of the Electronic Funds Resetting System (EFRS) to process resetting data for these systems. We will continue to process data for traditional postage meters under the Computerized Meter Resetting System (CMRS). Other proposed changes include modifying the forms of payment the Postal Service will accept, and changing the policy for refunds for unused IBI postage and for the balance remaining on a postal security device (PSD) that is withdrawn from service.

We are reissuing the policies and regulations in this proposal for public comment because we made extensive changes. We will revise the proposed IBI policies and regulations, if required, and publish them as a final rule after we review the comments.

DATES: Comments must be received on or before December 1, 2000.

ADDRESSES: Written comments should be mailed or delivered to the Manager, Postage Technology Management, USPS Headquarters, 475 L'Enfant Plaza SW, Room 8430, Washington, DC 20260-2444. Copies of all written comments will be available at this address for inspection and photocopying between 9 a.m. and 4 p.m., Monday through Friday.

FOR FURTHER INFORMATION CONTACT: Nicholas S. Stankosky, 202-268-5311.

SUPPLEMENTARY INFORMATION: Postage evidencing systems covered by these regulations include all those systems that generate information-based indicia (IBI) and use a postal security device (PSD). The characteristics of these systems enable the Postal Service to scan indicia to detect fraud. Core security functions, such as digital signature generation, digital signature verification, and the management of postage registers are performed by the PSD. The IBI contains a two-dimensional barcode that incorporates a cryptographic digital signature. The component of these postage evidencing systems that controls the registered user infrastructure for system authorization, system audits, remote postage resetting, and production of the indicia is called the client system.

Authorized postage evidencing systems are available from authorized, commercial product service providers. The provider's infrastructure supports user registration (formerly ``licensing''), PSD management and life cycle support, and an interface between the client system and the Postal Service infrastructure. The Postal Service infrastructure supports the issuance of user registrations, updating user registration information, PSD inventory and tracking, resetting, account reconciliation, lost and stolen/irregularity monitoring, and the assignment of digital certificates.

The Following is a Summary of the Postal Service's Position on Some General Interest Policy Issues for Postage Evidencing Systems That Generate IBI

1. Any proposed postage evidencing system that generates IBI must be submitted to the Postal Service for approval under the then current version of the postage evidencing product submission procedures. These procedures include specifics on letters of intent, nondisclosure agreements, the product service provider's concept of operations and infrastructure, documentation requirements, product submissions, and testing activities. Information pertaining to these

   [[Page 58683]]

   procedures may be accessed through the USPS Web site.

2. The user must register with the Postal Service before using a postage evidencing system that generates IBI.

3. PSDs remain the property of the USPS-authorized product service provider and are available only through a lease agreement with the provider. The software component of these postage evidencing systems is licensed to the registered user by the provider.

4. Until the Postal Service has recorded sufficient data on reliability and security, the total amount of postage in a descending register, which shows the amount of postage available, will be limited to an amount established by the Postal Service.

5. Authorized providers must keep records of the distribution, maintenance, replacement, and disposal of all PSDs throughout the complete life cycle of the PSD. All PSDs must be tracked, including newly produced PSDs; active leased PSDs; and inactive unleased PSDs; and lost, stolen, and scrapped PSDs.

6. Indicia produced by these postage evidencing systems may be used to indicate postage for single-piece rate First-Class Mail (including Priority Mail), single-piece rate International Mail, Standard Mail (B); and Express Mail, Express Mail International Service, Global Priority Mail, and Priority Mail Global Guaranteed. Mail bearing the indicia is entitled to all privileges and subject to all conditions applying to these classes of mail.

7. Providers are responsible for audit functions. The Postal Service will not take over this function, but may at times participate in or review the audit process. PSDs must be audited at least once every 3 months.

8. To ensure the quality and readability of the indicia, providers must perform an analysis of the mailpieces that registered users submit every 6 months for the provider's mailpiece quality assurance program. The provider must notify the registered user and the Postal Service of any deficiencies and provide guidance to the user to correct any deficiencies that are discovered.

9. All postage downloads or settings will be made under the provisions of the Electronic Funds Resetting System (EFRS). The Postal Service will conduct periodic audits of the provider's resetting system to ensure that the system is operating correctly and that postal revenues are protected.

10. The Postal Service may physically inspect a PSD if it has a reason to suspect a security problem.

11. The Postal Service will provide refunds through the product service providers, in accordance with Postal Service procedures, for printed but unused postage and for the full postage value balance remaining on a PSD that is withdrawn from service.

12. The provider must supply registered users with modifications reflecting rate changes and must implement new rates as of the effective date for the new rates established by the Postal Service.

13. There are provisions in the regulations for the correction of postage and dates. For date correction, the facing identification mark (FIM) and two-dimensional barcode will be suppressed; for postage correction, the FIM will be suppressed.

14. The provider will make the registered user aware of the applicable Postal Service regulations pertaining to use of the information-based indicia and of the postage evidencing system that generates them through cautionary statements in the system software, system documentation, and product labeling, as appropriate.

    List of Subjects in 39 CFR Part 111

    Administrative practice and procedure, Postal Service.

    Although exempt from the notice and comment requirements of the Administrative Procedure Act (5 U.S.C. 553(b), (c)) regarding proposed rulemaking by 39 U.S.C. 410(a), the Postal Service invites public comments on the following proposed amendments to the Domestic Mail Manual, incorporated by reference in the Code of Federal Regulations. See 39 CFR part 111.

    PART 111--[AMENDED]

1. The authority citation for 39 CFR part 111 continues to read as follows:

   Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 3001- 3011, 3201-3219, 3403-3406, 3621, 3626, 5001.

2. Add the following sections to the Domestic Mail Manual as set forth below:

   P050 Information-Based Indicia (IBI)

   1.0 BASIC INFORMATION

   1.1 Description of Postage Evidencing Systems that Generate Information-Based Indicia (IBI)

   Postage evidencing systems that generate information-based indicia (IBI) are secure systems that print USPS-authorized, digitally signed indicia to show payment of postage. These systems include as a primary component a postal security device (PSD) that performs core security functions such as digital signature generation and verification, as well as the management of postage registers. The component of these postage evidencing systems that controls the registered user infrastructure for system authorization, system audits, remote postage resetting, and production of the indicia is called the client system. The PSD and the client system interact to generate the indicia. Indicia consist of a USPS-approved two-dimensional barcode and certain human- readable information. Authorized postage evidencing systems are available from authorized, commercial product service providers. Avoiding the payment of postage by misusing a postage evidencing system is punishable by law.

   1.2 Product Service Provider Responsibilities

   Postal security devices (PSDs) remain the property of the USPS- authorized product service provider and are available only through a lease agreement with the provider. The software component of these postage evidencing systems is licensed to the registered user by the provider. The Postal Service holds providers responsible for the control, operation, distribution, maintenance, and replacement of the PSD throughout the entire life cycle of the PSD. The provider is also responsible for the secure disposal or destruction of the PSD at the end of its useful life.

   1.3 Product Service Providers

   Postage evidencing systems that generate IBI are available from authorized providers. The following providers have been approved as of September 2000: E-Stamp Corporation, 2051 Stierlin Court, Mountain View, CA 94043- 4655, www.estamp.com Neopost Online, 3400 Bridge Parkway, Suite 201, Redwood City, CA 94065-1168, www.neopostonline.com Pitney Bowes, Inc., 40 Lindeman Drive, Trumbull, CT 06611-4785, www.pitneybowes.com/soho/ Stamps.com, 3420 Ocean Park Boulevard, Suite 1040, Santa Monica, CA 90405-3035, www.stamps.com

   1.4 Possession

   No one other than an authorized product service provider may possess or use a PSD without a valid USPS-issued postage evidencing system user registration and a valid lease agreement with the provider. Any person in possession of a PSD without meeting these conditions must immediately surrender it to the provider or to the USPS.

   [[Page 58684]]

   1.5 Classes of Mail

   Information-based indicia (IBI) produced by an authorized postage evidencing system may be used to indicate postage for single-piece rate First-Class Mail (including Priority Mail), single-piece rate International Mail, and single-piece rate Standard Mail (B); also Express Mail, Express Mail Military Service, Express Mail International Service, Global Priority Mail, and Priority Mail Global Guaranteed. The indicia can be used to pay for special services. Mail prepared using such a system is entitled to all privileges and subject to all conditions that apply to the various mail classes and services.

   1.6 Amount of Postage

   The value of the indicia affixed to each mailpiece must equal or exceed the exact amount due for the piece when mailed. Refunds for overpayment must meet the standards in P014.

   1.7 Reply Postage

   A postage evidencing system that generates IBI may be used to prepare prepaid reply postage for the following domestic mail classes: All single-piece rate First-Class Mail (including Priority Mail), Standard Mail (B), and Express Mail. The prepaid reply mail must meet the following conditions:

   1. The postage amount in the indicium must be enough to prepay the postage in full.

   2. Indicium showing postage evidencing may be printed directly on the mailpiece or on a label and must be applied to a mailpiece in accordance with the directions in 4.4. An applied label must adhere well enough that it cannot be removed in one piece.

   3. The mailpiece must be pre-addressed for return to the registered user.

   4. If the postage evidencing system used to prepare the return postage indicium has the capability to print destination addresses for the given size and class of mailpiece, the address for returning the mailpiece to the registered user must be prepared using that system.

   5. For those postage evidencing systems without the capability to print an address for the given class or size of mailpiece, the address side of reply mail may be prepared by any photographic, mechanical, or electronic process or combination of such processes (other than handwriting, typewriting, or hand stamping).

   6. The address side of the mailpiece must follow the style and content of the example below. Nothing may be added except a return address and facing identification mark (FIM).

   7. If the reply mailpiece is letter-sized First-Class Mail, a FIM D is required when the indicium for reply postage is printed directly on the mailpiece.

   8. Prepaid reply mail is delivered only to the address of the registered user. If the address is altered, the mail is held for postage.

   9. IBI used to prepay reply postage must show the date the indicium was printed by the registered user, and must include the words ``REPLY POSTAGE''.

      [GRAPHIC] [TIFF OMITTED] TP02OC00.004

      2.0 USER REGISTRATION

      2.1 Procedures

      The user must register with the Postal Service before using a postage evidencing system that generates IBI. An applicant must apply for a user registration through the provider and submit to the provider all data required for a registration to lease and use postage evidencing systems. The application must show the post office where the applicant intends to deposit the mail. This is called the registration post office. An application for a user registration is processed through the Centralized Registration System (CRS), formerly the Centralized Meter Licensing System. The provider electronically transmits the required information to CRS in the USPS-specified format. There is no fee for the application or user registration. After approving an application, the Postal Service issues a postage evidencing system user registration, and notifies the appropriate provider. A single user registration covers all postage evidencing systems for the same applicant for the same post office, but a separate application must be submitted for each post office where the applicant intends to deposit mail. A single PSD can be registered to only one post office at any one time; it must be reauthorized by the provider for use at a different post office.

      2.2 Registered User's Agreement

      By submitting an application for a user registration, the applicant agrees that the registration may be revoked immediately and that the postage evidencing system may be withdrawn

      [[Page 58685]]

      from service by the provider or the USPS for the following reasons:

   1. The postage evidencing system is used in any fraudulent or unlawful scheme or enterprise.

   2. The postage evidencing system is not used for 12 consecutive months.

   3. The registered user fails to exercise sufficient control of the postage evidencing system or fails to comply with the standards for system care or use.

   4. The postage evidencing system is used outside the United States, its territories or its possessions, except as specifically authorized by these regulations or by the manager of Postage Technology Management, USPS Headquarters.

   5. IBI mail is deposited at other than the registration post office (except as permitted under 5.0 or D072).

   6. The registered user fails to forward mailpieces to the provider for quality assurance as required in 2.6.h.

      2.3 Refusal to Register a User

      The Postal Service notifies both the applicant and the provider when an application for user registration is refused. The notification is in writing and is sent certified mail, return receipt requested. Any applicant refused a user registration may appeal the decision under 2.5. The Postal Service may refuse to register a user for the following reasons:

   1. The applicant submitted false information on the user registration application.

   2. The applicant violated any standard for the care or use of a PSD, postage evidencing system, information-based indicia, or postage meter that resulted in the revocation of that applicant's user registration or postage meter license within 5 years preceding submission of the application.

   3. There is sufficient reason to believe that the postage evidencing system is to be used in violation of Postal Service regulations.

      2.4 Revocation of a User Registration

      The Postal Service notifies the registered user of any revocation. The Postal Service also notifies the registered user's provider of the revocation so that the provider can cancel the lease agreement and withdraw the postage evidencing system from service. The notification is in writing and is sent certified mail, return receipt requested. Revocation takes effect 10 calendar days after the registered user receives or refuses to receive the revocation notice unless, within that time, the registered user appeals the decision under 2.5. A user registration is subject to revocation for any of the following reasons:

   1. The postage evidencing system is used for any illegal scheme or enterprise or there is probable cause to believe that the system is to be used in violation of the applicable standards.

   2. The user registration does not have a postage evidencing system applied against it or the registered user's postage evidencing system has not been reset within the last 12 months.

   3. Sufficient control of the postage evidencing system is not exercised or the standards for its care or use are not followed.

   4. The postage evidencing system is kept or used outside the customs territory of the United States or those U.S. territories and possessions where the Postal Service operates, except as specified in 2.11 or 2.12.

   5. IBI mail is deposited at other than the registration post office (except as permitted under 5.0 or D072).

   6. The registered user fails to forward mailpieces to the provider for quality assurance as required in 2.6.h.

      2.5 Appeal Process

      An applicant who is refused a user registration, or a registered user whose registration is revoked, may file a written appeal with the manager of Postage Technology Management, USPS Headquarters, within 10 calendar days after receiving or refusing to receive notification of the decision.

      2.6 Registered User's Responsibilities

      The registered user's responsibilities for the care and use of a postage evidencing system that generates IBI include the following:

   1. A PSD that is delivered to a registered user must remain in the registered user's custody until it is returned to the authorized provider, or to the Postal Service, or is removed by the U.S. Postal Inspection Service.

   2. Some postage evidencing systems maintain a log file that automatically records all transactions relating to indicia creation, funds transfer (including postage value download), and postal security device audits which is transmitted automatically to the provider by the system with each connection. The registered user may not manipulate these log files to reflect an inaccurate record of transactions or prevent the transmission of these log files to the provider.

   3. The registered user must, upon request, make immediately available for review and audit by the provider or by the Postal Service any PSD in the user's custody and the corresponding transaction records.

   4. The registered user must reset the PSD at least once every 3 months to meet provider audit and examination requirements. A zero value reset will meet this requirement.

   5. The registered user must update information with the provider whenever there is any change in the user's name, address, telephone number, location of the PSD, registration post office, or any other required user registration information. The Postal Service will issue a revised user registration based on the transmission of updated information from the provider.

   6. The registered user must report a misregistering or otherwise defective PSD to the provider under 2.8, and must ensure that the defective PSD is not used. Anyone in possession of a misregistering or otherwise defective PSD must return it to the provider within 3 business days.

   7. For postage evidencing systems that generate IBI and access the USPS Address Management System (AMS) CD-ROM, the registered user must maintain address quality by ensuring the CD-ROM is updated at least once every 6 months.

   8. The registered user must forward a mailpiece with an indicium produced by the postage evidencing system to the provider for quality assurance when the system is installed and at least once every 6 months thereafter, in accordance with provider directions.

   9. The registered user must enter into a signed lease agreement with the provider that includes a financial agreement for resetting the PSD with postage and the Postage Payment Agreement. The Postal Service is not a party to the lease agreement, except to the extent that it may enforce the Postage Payment Agreement.

   10. The registered user must ensure that the cautionary information placed by the provider in system documentation, on the opening screens at system start-up, or on labels attached to the PSD or its housing, is not removed or destroyed while the postage evidencing system is in the registered user's possession. The cautionary information contains basic reminders on ownership and use of the PSD, warnings against system tampering or misuse resulting in non-payment of postage owed, and the penalties for such system misuse. Postage evidencing systems without this cautionary information shall not be authorized for use.

       2.7 Custody of Suspect PSDs

       The Postal Service may conduct unannounced, on-site examinations of PSDs reasonably suspected of being manipulated or otherwise defective. A

       [[Page 58686]]

       postal inspector also may immediately withdraw a suspect PSD from service for physical and/or laboratory examination. The inspector withdrawing a suspect PSD issues the registered user a receipt for the PSD; forwards a copy to the provider; and, if necessary, assists in obtaining a replacement PSD. Where possible, the Inspection Service gives advance notice to the provider that a PSD is to be inspected. Unless there is reason to believe that the PSD is fraudulently set with postage, existing postage in the PSD is refunded to the registered user, in accordance with established refund procedures, when it is withdrawn from service.

       2.8 Defective PSD

       The registered user must immediately report any defective PSD to the provider. The provider must retrieve any defective PSD in a user's possession within 3 business days of notification by the registered user, and must notify the manager of Postage Technology Management, USPS Headquarters, immediately. A faulty PSD may not be used under any circumstance. The provider supplies the registered user with a replacement PSD only if the faulty PSD is in the provider's possession.

       2.9 Missing PSD

       The registered user must immediately report to the provider the loss or theft of any PSD or the recovery of any missing PSD. Reports must include the postal security device identification number of the PSD; the date, location, and details of the loss, theft, or recovery; and a copy of any police report. The provider will report all details of the incident to the manager of Postage Technology Management, USPS Headquarters.

       2.10 Returning a PSD

       A registered user in possession of a faulty or misregistering PSD, or who no longer wants to keep a PSD, must return the PSD to the provider to be withdrawn from service. PSDs must be shipped by Priority Mail unless the manager of Postage Technology Management, USPS Headquarters, gives written permission to ship at another rate or special service.

       2.11 Approval for Use of Postage Evidencing Systems at Military Post Offices

       A person authorized by the Department of Defense to use the services of an overseas military post office, such as an APO or FPO, is allowed to use a USPS-approved postage evidencing system that generates IBI in accordance with the same regulations that apply to domestic users. For such users, the APO or FPO will be designated as the registration post office on their user registration. These users must deposit the mail prepared with their system at the registration post office.

       2.12 Approval for Use of Postage Evidencing Systems Outside the Country

       Under certain conditions, with specific approval from the manager of Postage Technology Management, USPS Headquarters, registered users (other than those with access to an overseas military post office) may use postage evidencing systems that generate IBI outside the customs territory of the United States to print evidence of U.S. postage. The procedures and conditions are as follows:

   1. The potential users must maintain a permanent, established business address in the United States. Any exceptions must be specifically approved in writing by the manager of Postage Technology Management, USPS Headquarters (see G043).

   2. All registered users who use a USPS-approved postage evidencing system outside the customs territory of the United States are subject to all Postal Service regulations and U.S. statutes pertaining to mail, mail fraud, and misuse of postage evidencing systems.

   3. All postage evidencing systems authorized by the USPS for use in foreign locations must have enhanced security features. Only those systems specifically approved in writing by the manager of Postage Technology Management, USPS Headquarters, may be used outside the customs territory of the U.S.

   4. Potential users must submit all data required for the application for a registration to lease and use postage evidencing systems to the provider. The provider will annotate the application to state that it is for the foreign use of a U.S. postage evidencing system and show where the system is to be located. The provider must submit the application to the manager of Postage Technology Management, USPS Headquarters, for review and approval. Once an application is approved, Postage Technology Management will designate the registration post office and notify the provider and the registered user. Multiple foreign postage evidencing systems for the same registered user at the same registration post office may be covered by one foreign user registration. Mailers who currently have a user registration must apply for a separate foreign user registration to participate in this program.

   5. The provider selected by the registered user must agree in writing to all terms and conditions established by the Postal Service pertaining to the distribution of U.S. postage evidencing systems outside of the United States.

      Once the postage evidencing system is installed, the provider must provide the information required for Form 3601-C, Postage Evidencing System Activity Report, and submit it directly to the manager of Postage Technology Management, USPS Headquarters (see G043).

   6. Mail to which an IBI is applied as postage evidencing must use domestic U.S. postage and must be entered at the registration post office. 3.0 SETTING

      3.1 Initialization and Authorization of the PSD

      Before the registered user can print evidence of postage, the PSD must be initialized and authorized by the provider. The initialization process installs PSD-specific information that does not change over the life cycle of the PSD. The authorization process is the setting of user-specific information. The PSD is reauthorized by the provider when certain user-specific information changes. Settings are made in accordance with the provisions of the USPS Electronic Funds Resetting System (EFRS).

      3.2 Relocation of Registered User

      If a registered user changes the post office at which IBI mail is to be deposited, the provider must reauthorize the PSD for the new registration post office. The user must notify the provider and must be registered at the new registration post office before the provider can reauthorize the PSD.

      3.3 Payment for Postage

      The Postal Service will accept payment only in the following forms: Automated Clearinghouse (ACH) debit and credit card.

      3.4 Resetting

      To reset a PSD the following conditions must be met:

   1. The registered user shall initiate payment to the Postal Service sufficient to cover the desired postage increment before requesting a postage value download to reset the PSD.

   2. As part of the resetting procedure, the registered user must provide identifying information and PSD audit data as required by the Postal Service and in accordance with the provider's

      [[Page 58687]]

      resetting specifications. Before completing the PSD resetting, the provider must verify the identifying data, authenticate the registered user, conduct the postage evidencing system audit, and ascertain whether payment to the Postal Service sufficient to cover the requested postage value download was initiated by the registered user.

   3. The provider will supply the registered user with documentation of the reset transaction and the balance on the PSD.

      3.5 Postage Refunds

      The Postal Service provides refunds for the entire postage value balance remaining on a PSD that is withdrawn from service and is in the possession of the provider. Refunds are requested and paid through the provider. Refunds for postage already printed onto an envelope or label are made in accordance with P014. Postage losses due to malfunctions are the responsibility of the provider.

      3.6 Postage Adjustment for Faulty or Misregistering PSD

      If the registered user requests a postage adjustment for a faulty or misregistering PSD, then the PSD must be withdrawn from service and must be in the possession of the provider for examination. The provider will examine the PSD in comparison with the data from the registered user's log files. After examining a PSD withdrawn from service for apparent faulty operation affecting the ascending or descending registers, the provider must report the malfunction to the manager of Postage Technology Management, USPS Headquarters. The report must contain all applicable documentation (including a copy of the registered user's log files) and a recommendation for the appropriate postage adjustment. At the same time the report is made to the Postal Service, the provider must notify the registered user of the proposed postage adjustment. A registered user may appeal a postage adjustment to the manager of Postage Technology Management, USPS Headquarters, within 60 calendar days of the date that the provider submitted the postage adjustment recommendation to the Postal Service.

      3.7 Periodic Examinations

      The registered user must reset the PSD at least once every 3 months. A zero-value reset meets this requirement. The Postal Service reserves the right to examine PSDs by remote access or otherwise.

      3.8 Amount of Postage Available

      The descending register of the PSD, which shows the amount of postage remaining, is programmed not to exceed a specified amount established by the Postal Service, for a given registered user at any time. 4.0 INDICIA

      4.1 Designs

      The indicia designs (types, sizes, and styles) must be those that the provider specified when the postage evidencing system was approved by the Postal Service for production and distribution (see Exhibit 4.1).

      [Exhibit 4.1, which shows all approved indicia designs, will be included when these regulations are published in final form in the Domestic Mail Manual.] * * * * *

      4.2 Legibility

      The indicia must be legible. Illegible indicia are not acceptable for the payment of postage. Should there be a need to place multiple indicia on an envelope (e.g., for redate and/or postage correction) the indicia must not overlap each other. The address and POSTNET barcode must meet the specifications listed in C840. Reflectance measurements of the indicia and the background material must meet the standards in C840.5.

      4.3 On an Adhesive Label

      A label used to apply information-based indicia to a mailpiece for postage evidencing must be approved by the manager of Postage Technology Management, USPS Headquarters. Failure to use a USPS- approved label may result in revocation of the user registration for the postage evidencing system. The label must meet the following requirements:

   1. The label must be a pressure-sensitive, permanent label. The label is subject to the corresponding standards in C810.6.2 for minimum peel adhesion. The applied label must adhere well enough that it cannot be removed in one piece. A face stock/liner, or ``sandwich,'' label must not be used for printing information-based indicia.

   2. The label must meet the reflectance requirements in C840.5.0.

   3. The label must be large enough to contain the entire information-based indicia.

   4. Information-based indicia printed on a label must be the same as the indicia approved by the manager of Postage Technology Management for printing directly on an envelope. The label must not include any image or text other than that required by the IBI performance criteria or as required or recommended by Postal Service regulation.

   5. For labels applied to standard letter-sized envelopes and postcards sent as First-Class Mail, the label must have fluorescent striping that meets the following requirements:

      (1) A stripe along the right side (leading edge) of the label that is \1/4\ inch wide and extends a minimum of \1/2\ inch and a maximum of 1\1/2\ inches from the top of the label.

      (2) A stripe along the top edge of the label that is \1/4\ inch wide and extends a minimum of \1/2\ inch and a maximum of 1\1/2\ inches from the right edge of the label.

      (3) All stripes must have a minimum fluorescent emission intensity of at least 20 phosphor meter units (PMU), with a maximum of 70 PMU. The visible color of the fluorescent tagging may be any color that meets the fluorescence requirements.

      (4) The fluorescent tagging shall exhibit no noticeable change (i.e., no more than 10 percent) in its emission when exposed to elevated temperature and/or high humidity conditions.

   6. The label must be placed on the envelope such that the position of the indicia meets the requirements in 4.4.

   7. If the label is applied to an envelope that already has a FIM, then the existing FIM cannot be covered by the label.

      4.4 Position

      The indicia must be printed or applied in the upper right corner of the envelope. The indicia must be at least \1/4\ inch from the right edge of the mailpiece and \1/4\ inch from the top edge of the mailpiece. The barcode in the indicia must be horizontally oriented. If a FIM is printed with the indicia, the position of the FIM must meet the requirements in C100.5.0. The indicia must not infringe on the areas reserved for the FIM, POSTNET barcode, or optical character reader (OCR) clear zone.

      4.5 Content and Format

      The boundaries of the indicium are defined by the right-hand edge of the envelope, the top edge of the envelope, the bottom edge of the two-dimensional barcode or any indicium element below the barcode, and the left-most edge of the two-dimensional barcode or any indicium element to the left of the barcode. A \1/2\ inch clear zone, within which nothing shall be printed by the postage evidencing system, must surround the indicium boundaries to

      [[Page 58688]]

      the left of and below all elements of the indicium.

      The manager of Postage Technology Management, USPS Headquarters, must approve the contents and format of all indicia that will be produced by a postage evidencing system. This approval shall include all elements in the indicium required by the IBI performance criteria and/or Postal Service regulations and applies to the entire area within the indicium boundaries. The USPS-approved indicia supplied by the provider consist of human-readable information and two-dimensional barcoded information. For the contents of indicia used for prepaid reply mail, see 1.7; for the contents of redate indicia, see 4.8; and for the contents of postage correction indicia, see 4.9. The contents of other indicia is as follows:

   1. Unless otherwise approved by the manager of Postage Technology Management, USPS Headquarters, the required human-readable information must show, at a minimum, the city, state, and 5-digit ZIP Code of the registration post office; the postal security device ID; date of mailing; endorsement or mail class; the words ``US Postage''; and the postage amount. The Arial font must be used for this information. The postage amount must use at least 10-point type size. For all other required information, the type size must be at least 8 points. The mail class or endorsement, the postage amount, and the words ``US Postage'' must be in bold type and all letters must be capital letters. The remaining required information (city, state and 5-digit ZIP Code, the date, and the postal security device ID) need not be capitalized or bold. The type size used for all other information printed in the indicia must be no greater than 8 points and must not be in bold type.

   2. As an alternative to the city, state, and 5-digit ZIP Code of the registration post office, the indicia may show the ZIP Code rather than the city and state designation. In this case, the words ``Mailed From ZIP Code'' and the ZIP Code of the registration post office may appear in place of the city and state, respectively.

   3. When it is necessary to print multiple indicia on a given mailpiece, the human-readable information showing the registration post office must be included in each.

   4. The requirements for the data elements of the two-dimensional barcode are found in the performance criteria for the given postage evidencing system.

      4.6 Complete Date

      The month, day, and year must be shown in human-readable form in the indicia. The year must be represented by four digits.

      4.7 Date Accuracy

      The date of mailing in the indicium must be the actual date of deposit, except that mail deposited in a collection box after the day's last scheduled collection may bear the actual date of deposit or the date of the next scheduled collection.

      If the registered user knows the mail will not be tendered to the Postal Service on the date of mailing shown in the indicium, the user should use a date correction indicium (see 4.8) or have the postage evidencing system advance the date and print the intended date of deposit in the indicium.

      4.8 Date Correction

      If date correction is required, indicia showing only the actual date of mailing and the word ``REDATE'' instead of the postage amount shall be used. On letter-sized mail, date correction indicia must be placed on the nonaddress side at least \3/4\ inch from the bottom edge of the mailpiece and not on an envelope flap. On flats or parcels, it must be placed next to the original indicium. Date correction indicia must not include the FIM or the two-dimensional barcode. The redate indicium may be printed on a USPS-approved label instead of directly on the mailpiece.

      4.9 Postage Correction

      Indicia for additional postage may be placed on a shortpaid mailpiece to correct postage. On letter-size mail, correction indicia must be printed on the nonaddress side at least \3/4\ inch from the bottom edge of the mailpiece and not on an envelope flap. On flats or parcels, it must be placed next to the original indicium. The postage correction indicium must contain all of the elements required for the indicium in 4.5 except for the destination delivery point. The word ``CORRECTION'' must be added to the human readable information. Postage correction indicia must not include the FIM. To meet two-dimensional barcode readability requirements, postage correction indicia may be printed on a USPS-approved label instead of directly on the mailpiece.

      4.10 Use of Indicia

      Valid information-based indicia produced by postage evidencing systems shall be used only to show evidence of payment for postage or postal services. In any illustration of information-based indicia, or for any other non-postal use, the two-dimensional barcode shall be rendered unreadable, for example by printing ``VOID'' or similar text across the barcode.

      4.11 Other Printed Matter

      An approved indicium shall include within its boundaries only postal markings and text required or recommended by Postal Service regulation, except that the indicium may identify the product service provider. Other printed matter may be printed only outside the boundaries of the clear zone (see 4.5) surrounding the indicium. Such printed matter may not be obscene, defamatory of any person or group, or deceptive, and it must not advocate any unlawful action.

      4.12 Postal Markings

      Postal markings related to the mail class, subclass, or category of mail are required in the indicia.

      4.13 Facing Identification Mark (FIM)

      The facing identification mark (FIM) serves to orient and separate certain types of First-Class Mail during the facing and canceling process. Letter-sized First-Class Mail with the IBI printed directly on the envelope must bear a USPS-approved FIM D unless it is courtesy reply mail. The FIM must meet the dimensions, print quality, and placement specified in the C100.5. 5.0 MAILINGS

      5.1 Preparation of IBI Mail

      Mail is subject to the preparation standards that apply to the class of mail and rate claimed.

      5.2 Where to Deposit

      Single-piece rate First-Class Mail (including Priority Mail), Standard Mail (B), and expedited mail may be deposited in any street collection box or other place where mail is accepted and that is served by the registration post office. International mail weighing less than 16 ounces may be deposited in any street collection box in accordance with the regulations for domestic mail. Limited quantities (i.e., a handful) of single-piece rate First-Class Mail including Priority Mail, expedited mail, and international mail may be deposited at offices other than the registration post office to expedite dispatch, with the following exceptions:

   1. Certain Special Postal Services require that the mail be presented directly to a Postal Service employee (see S900).

   2. A registered user authorized to use an APO or FPO as the registration post

      [[Page 58689]]

      office shall deposit mail only at the registration APO or FPO.

   3. All other registered users who have Postal Service approval to use a postage evidencing system that generates IBI outside the country shall deposit mail only at their domestic registration post office.

   4. International mail that requires a customs declaration, or that weighs 16 ounces or over, must be given directly to a Postal Service employee at the registration post office or other location designated by the postmaster. Otherwise, the mail will be returned to the sender for proper entry and acceptance. See the International Mail Manual for additional information. 6.0 AUTHORIZATION TO PRODUCE AND DISTRIBUTE POSTAGE EVIDENCING SYSTEMS THAT GENERATE INFORMATION-BASED INDICIA (IBI)

      Title 39, Code of Federal Regulations, part 502, contains information concerning authorization to produce and distribute postage evidencing systems that generate information-based indicia (IBI), the suspension and revocation of such authorization; performance standards, test plans, testing, and approval; required production security measures; and standards for distribution and maintenance. Further information may be obtained from the manager of Postage Technology Management, USPS Headquarters.

      List of Subjects in 39 CFR Part 502

      Administrative practice and procedure, Postal Service.

      Although exempt from the notice and comment requirements of the Administrative Procedure Act (5 U.S.C. 553(b), (c)) regarding proposed rulemaking by 39 U.S.C. 410(a), the Postal Service invites public comments on the following proposed amendments to the Code of Federal Regulations. For the reasons set out in this document, the Postal Service proposes to add 39 CFR part 502 as follows:

      PART 502--AUTHORITY TO PRODUCE AND DISTRIBUTE POSTAGE EVIDENCING SYSTEMS THAT GENERATE INFORMATION--BASED INDICIA (IBI)

      Sec. 502.1 Applicability of regulations. 502.2 Description of postage evidencing systems that generate information-based indicia (IBI). 502.3 Definition and use of PC Postage trademark. 502.4 Product service provider qualifications. 502.5 Provider authorization. 502.6 Changes in ownership or control. 502.7 Burden of proof standard. 502.8 Suspension and revocation of authorization. 502.9 Information-based indicia program (IBIP) performance criteria. 502.10 Product submission procedures and testing. 502.11 Security testing. 502.12 Postage evidencing system approval. 502.13 Conditions for approval. 502.14 Suspension and revocation of approval. 502.15 Reporting. 502.16 Administrative sanction on reporting. 502.17 Materials and workmanship. 502.18 Destruction of information-based indicia. 502.19 Inspection of new postage evidencing systems. 502.20 Distribution facilities. 502.21 Distribution controls. 502.22 Administrative sanction. 502.23 Postage evidencing system maintenance. 502.24 Access or changes to secure components. 502.25 Inspection of postal security devices (PSDs) in use. 502.26 PSDs not located. 502.27 Electronic Funds Resetting System (EFRS). 502.28 Indicia quality assurance. 502.29 Refunds for postage evidencing systems that generate information-based indicia. 502.30 Registered user information. 502.31 Intellectual Property.

      Authority: 5 U.S.C. 552(a); 39 U.S.C. 101, 401, 403, 404, 410, 2601, 2605; Inspector General Act of 1978, as amended (Pub. L. 95- 452, as amended), 5 U.S.C. App 3.

      Sec. 502.1 Applicability of regulations.

      The regulations in this section apply to all postage evidencing systems that print information-based indicia (IBI) to show payment of postage.

      Sec. 502.2 Description of postage evidencing systems that generate information-based indicia (IBI).

      (a) Postage evidencing systems that generate IBI are secure systems that print USPS-authorized, digitally-signed indicia as evidence of payment of postage. Indicia consist of a USPS-approved two-dimensional barcode and certain human-readable information. Authorized postage evidencing systems are available from authorized, commercial product service providers.

      (b) These postage evidencing systems include as a primary component a postal security device (PSD) that performs core security functions such as digital signature generation and verification, as well as the management of postage registers. The component of these postage evidencing systems that controls the registered user infrastructure for system authorization, system audits, remote postage resetting, and production of the indicia is called the client system. The PSD and the client system interact to generate the indicia. The PSD is remotely set with postage value and requires the user to initiate payment to the Postal Service sufficient to cover the desired postage increment before initial setting or resetting.

      Sec. 502.3 Definition and use of PC Postage trademark.

      (a) ``PC Postage'' is the Postal Service trademark for Postal Service-approved, secure, postage evidencing systems that generate information-based indicia and allow registered users to purchase and print postage using their personal computers and the Internet.

      (b) Use of the PC Postage trademark on USPS-approved postage evidencing systems and other products must be specifically approved by the manager of Postage Technology Management (PTM), USPS Headquarters. The provider must sign a trademark licensing agreement with the Postal Service for each product the Postal Service authorizes to use the PC Postage trademark.

      Sec. 502.4 Product service provider qualifications.

      For authorization from the Postal Service to produce and/or lease PSDs and postage evidencing systems that generate information-based indicia (IBI) for use by registered users under Domestic Mail Manual P050, a potential provider must:

      (a) Satisfy the Postal Service of its integrity and fiscal responsibility.

      (b) Obtain approval of at least one postage evidencing system incorporating all the features and safeguards specified in Sec. 502.9, in accordance with the procedures outlined in Sec. 502.10.

      (c) Have, or establish, and keep under its supervision and control adequate production facilities suitable to carry out the provisions of Secs. 502.17 through 502.19, to the satisfaction of the Postal Service. The production facilities must be subject to unannounced inspection by representatives of the Postal Service. If the production facilities are established by the provider outside the customs territory of the United States, the provider shall be responsible for all costs incurred by the Postal Service to conduct the inspections.

      (d) Have, or establish, and keep under its supervision and control adequate facilities for the control, distribution, and maintenance of postage evidencing systems that generate IBI, and their

      [[Page 58690]]

      replacement or secure disposal or destruction when necessary.

      Sec. 502.5 Provider authorization.

      An applicant meeting the qualifications in Sec. 502.4 may be authorized in writing by the manager of Postage Technology Management, USPS Headquarters, as a provider of postage evidencing systems that generate IBI and will be allowed to lease authorized PSDs and systems to users registered by the Postal Service. The written authorization defines the conditions under which the postage evidencing system may be marketed and distributed.

      Sec. 502.6 Changes in ownership or control.

      Any person, entity, or concern wanting to acquire ownership or control of a provider of an authorized postage evidencing system must provide the Postal Service with satisfactory evidence of that person's, entity's, or concern's integrity and financial responsibility.

      Sec. 502.7 Burden of proof standard.

      The burden of proof is on the Postal Service in adjudications of suspensions and revocations under Sec. 502.8 and Sec. 502.14 and administrative sanctions under Sec. 502.16 and Sec. 502.22. Except as otherwise indicated in those sections, the standard of proof shall be the preponderance-of-evidence standard.

      Sec. 502.8 Suspension and revocation of authorization.

      (a) The Postal Service may suspend and/or revoke authorization to provide and/or distribute any or all of a provider's postage evidencing systems if the provider engages in any unlawful scheme or enterprise, fails to comply with any provision in this part 502, or fails to implement instructions issued in accordance with any final decision issued by the Postal Service within its authority over the IBI program.

      (b) The decision to suspend or revoke a provider's authorization shall be based on the nature and circumstances of the violation (e.g., whether the violation was willful, whether the provider voluntarily admitted to the violation, whether the provider cooperated with the Postal Service, or whether the provider implemented successful remedial measures) and on the provider's performance history. Before determining whether a provider's authorization to produce and/or distribute postage evidencing systems should be revoked, the procedures in paragraph (c) of this section shall be followed.

      (c) Suspension in all cases shall be as follows:

      (1) Upon determination by the Postal Service that a provider is in violation of the provisions in this part 502, the Postal Service shall issue a written notice of proposed suspension citing deficiencies for which suspension of authorization to produce and/or distribute a specific postage evidencing system, or a family of system models, may be imposed under paragraph (c)(2) of this section. The notification is in writing and is sent certified mail, return receipt requested. Except in cases of willful violation, the provider shall be given an opportunity to correct deficiencies and achieve compliance with all requirements within a time limit, determined by the Postal Service, corresponding to the potential risk to postal revenue.

      (2) In cases of willful violation, or if the Postal Service determines that the provider has failed to correct cited deficiencies within the specified time limit, the Postal Service shall issue a written notice setting forth the facts and reasons for the decision to suspend and the effective date if a written defense is not presented as provided in paragraph (d) of this section. The notification is in writing and is sent certified mail, return receipt requested.

      (3) If, upon consideration of the defense as provided in paragraph (e) of this section, the Postal Service deems that the suspension is warranted, the suspension shall remain in effect for up to 90 days unless withdrawn by the Postal Service, as provided in paragraph (c)(4)(iii) of this section.

      (4) At the end of the 90-day suspension, the Postal Service may:

      (i) Extend the suspension to allow more time for investigation or to allow the provider to correct the problem;

      (ii) Make a determination to revoke authorization to provide and/or distribute the provider's postage evidencing systems that generate IBI in part or in whole; or

      (iii) Withdraw the suspension based on identification and implementation of a satisfactory solution to the problem. Provider suspensions may be withdrawn before the end of the 90-day period if the Postal Service determines that the provider's solution and implementation are satisfactory.

      (d) The provider may present the Postal Service with a written defense to any suspension or revocation determination within 30 calendar days after receiving or refusing to receive the written notice, unless a shorter period is deemed necessary. The defense must include all supporting evidence and specify the reasons for which the order should not be imposed.

      (e) After receipt and consideration of the defense, the Postal Service shall advise the provider of the decision and the facts and reasons for it. The decision shall be effective on receipt unless it provides otherwise. The decision shall also advise the provider that it may appeal that determination within 30 calendar days after the provider receives or refuses to receive written notification of the decision, unless a shorter period is deemed necessary, as specified therein. The appeal must include all supporting evidence and specify the reasons the provider believes that the decision is erroneous.

      (f) An order or final decision under this section does not preclude any other criminal or civil statutory, common law, or administrative remedy that is available by law to the Postal Service, the United States, or any other person or concern.

      Sec. 502.9 Information-based indicia program (IBIP) performance criteria.

      (a) The performance criteria applicable to the given postage evidencing system relate to the data contents and format of the indicia, the PSD (which implements digital signature technology for the creation and verification of digital signatures), the client system (which supports the creation of the indicia and the interface with the PSD and the provider), and cryptographic key management.

      (b) The information-based indicia program (IBIP) performance criteria describe required system elements that include the provider infrastructure and the registered user infrastructure, and their interface to the Postal Service infrastructure. The Postal Service infrastructure supports user registration, postage evidencing system audit, postage resetting, total population management, key management support, financial reconciliation, PSD life cycle tracking, lost and stolen/irregularity management functions and other reporting. The provider infrastructure will support all IBIP functions. The registered user infrastructure will consist of the PSD and a client system. The Postal Service will evaluate and test postage evidencing systems for compliance with this infrastructure. Contact the manager of Postage Technology Management, USPS Headquarters for these criteria.

      Sec. 502.10 Product submission procedures and testing.

      (a) Each postage evidencing system that generates IBI is submitted for Postal Service approval and will be tested and evaluated in accordance with the requirements and provisions of the most

      [[Page 58691]]

      current postage evidencing product submission procedures. Particular attention must be given to the requirement to submit identical postage evidencing systems simultaneously to the Postal Service and to a laboratory accredited under the National Voluntary Laboratory Accreditation Program (NVLAP) for FIPS 140-1 certification. Contact the manager of Postage Technology Management, USPS Headquarters for these requirements. Information pertaining to these procedures may be accessed through the USPS website.

      (b) The indicia design must be approved by the manager of Postage Technology Management, USPS Headquarters, and must comply with the requirements in the Domestic Mail Manual and the applicable IBI performance criteria.

      (c) Any change to an approved postage evidencing system must be submitted to the Postal Service for evaluation in accordance with the most current postage evidencing product submission procedures.

      (d) Where complete evaluation of all security-related components of a postage evidencing system requires USPS review of data located outside the customs territory of the United States, the provider shall be responsible for all costs incurred by the USPS in conducting that review.

      Sec. 502.11 Security testing.

      The Postal Service reserves the right to require or conduct additional examination and testing at any time, without cause, of any postage evidencing system submitted to the Postal Service for approval or previously approved by the Postal Service for production and distribution.

      Sec. 502.12 Postage evidencing system approval.

      As provided in Sec. 502.15, the provider has a duty to report security weaknesses to the Postal Service to ensure that every postage evidencing system in service protects the Postal Service against loss of revenue at all times. An approval of a system does not constitute an irrevocable determination that the Postal Service is satisfied with its revenue-protection capabilities and all other features of the system. After approval is granted to produce and distribute a postage evidencing system, no change affecting the features or safeguards may be made except as authorized or required by the Postal Service in writing.

      Sec. 502.13 Conditions for approval.

      (a) The Postal Service may require, and reserves future rights to require, that production models of approved postage evidencing systems, as well as the current design documentation, user manuals, and specifications applicable to such systems and any revisions thereof, be submitted to the manager of Postage Technology Management, USPS Headquarters.

      (b) Upon request by the Postal Service, additional postage evidencing systems must be submitted to the Postal Service for testing, at the expense of the provider.

      Sec. 502.14 Suspension and revocation of approval.

      (a) The Postal Service may suspend approval of a postage evidencing system under Sec. 502.12 if the Postal Service has probable cause to believe that the postage evidencing system or the family of system models poses an unacceptable risk to postal revenue. Suspension of approval to produce or distribute a postage evidencing system or a family of system models, in whole or in part, shall be based on the potential risk to postal revenue. Before determining whether approval of a postage evidencing system or a family of system models, should be revoked, the procedures in paragraph (b) of this section shall be followed.

      (b) Suspension procedures:

      (1) Upon determination by the Postal Service that a postage evidencing system poses an unacceptable risk to postal revenue, the Postal Service shall issue a written notice of proposed suspension citing deficiencies for which suspension may be imposed under paragraph (b)(2) of this section. The notification is in writing and is sent certified mail, return receipt requested. The provider shall be given an opportunity to correct deficiencies and achieve compliance with all requirements within a time limit determined by the Postal Service, corresponding to the potential risk to postal revenue.

      (2) If the Postal Service determines that the provider has failed to correct cited deficiencies within the USPS-specified time limit, the Postal Service shall issue a written notice setting forth the facts and reasons for the decision to suspend and the effective date if a written defense is not presented as provided in paragraph (c) of this section. The notification is in writing and is sent certified mail, return receipt requested.

      (3) If, upon consideration of the defense as provided in paragraph (d) of this section, the Postal Service deems that the suspension is warranted, the suspension shall remain in effect for up to 90 days unless withdrawn by the Postal Service, as provided in paragraph (b)(4)(iii) of this section.

      (4) At the end of the 90-day suspension, the Postal Service may:

      (i) Extend the suspension to allow more time for investigation or to allow the provider to correct the problem;

      (ii) Make a determination to revoke the approval of the provider's postage evidencing system or family of system models, or

      (iii) Withdraw the suspension based on identification and implementation of a satisfactory solution to the problem. Provider suspensions may be withdrawn before the end of the 90-day period if the Postal Service determines that the provider's solution and implementation are satisfactory.

      (c) The provider may present the Postal Service with a written defense to any suspension or revocation determination within 30 calendar days after receiving or refusing to receive notice, unless a shorter period is deemed necessary. The defense must include all supporting evidence and specify the reasons for which the order should not be imposed.

      (d) After receipt and consideration of the written defense, the Postal Service shall advise the provider of the decision and the facts and reasons for it. The decision shall be effective on receipt unless it states otherwise. The decision shall also advise the provider that it may appeal that determination within 30 calendar days after the provider receives or refuses to receive written notice, unless a shorter period is deemed necessary, as specified therein. The appeal must include all supporting evidence and specify the reasons that the provider believes that the decision is erroneous.

      (e) An order or final decision under this section does not preclude any other criminal or civil statutory, common law, or administrative remedy that is available by law to the Postal Service, the United States, or any other person or concern.

      Sec. 502.15 Reporting.

      (a) For purposes of this section, ``provider'' refers to an entity authorized under Sec. 502.5 and its foreign or domestic affiliates, subsidiaries, assigns, dealers, independent dealers, employees, and parent corporations.

      (b) Each provider authorized under Sec. 502.5 must submit a preliminary report to notify the Postal Service promptly (in no event more than 21 calendar days of discovery) of the following:

      (1) All findings or results of any testing known to the provider concerning the security or revenue

      [[Page 58692]]

      protection features, capabilities, or failings of any postage evidencing system or PSD sold, leased, or distributed by the provider that has been approved for sale, lease, or distribution by the Postal Service or by any foreign postal administration; or have been submitted for approval by the provider to the Postal Service or to a foreign postal administration.

      (2) All potential security weaknesses or methods of system tampering of the postage evidencing systems that the provider distributes, of which the provider knows or should know, and the system or model subject to each weakness or method. These potential security weaknesses include, but are not limited to suspected equipment defects, suspected abuse by a registered user or provider employee, suspected security breaches of the Electronic Funds Resetting System, cryptographic key compromises, occurrences outside normal performance, or any repeatable deviation from normal postage evidencing system performance (within the same model family and/or by the same registered user).

      (c) Within 45 calendar days of the preliminary notification to the Postal Service under Sec. 502.15(b), the provider must submit a written report to the Postal Service. The report must include the circumstances, proposed investigative procedure, and the anticipated completion date of the investigation. The provider must also provide periodic status reports to the Postal Service during subsequent investigation and, on completion, must submit a summary of the investigative findings.

      (d) The provider must establish and adhere to timely and efficient procedures for internal reporting of potential security weaknesses. The provider is required to submit a copy of internal reporting procedures and instructions to the Postal Service for review.

      Sec. 502.16 Administrative sanction on reporting.

      (a) Notwithstanding any act, admission, or omission by the Postal Service, an authorized provider may be subject to an administrative sanction for failing to comply with Sec. 502.15.

      (b) The Postal Service shall determine all costs and revenue losses measured from the date that the provider knew, or should have known, of a potential security weakness, including, but not limited to, administrative and investigative costs and documented revenue losses that result from any postage evidencing system for which the provider failed to comply with any provision in Sec. 502.15. The provider shall be responsible to the Postal Service for all such costs and losses (net of any amount collected by the Postal Service from the registered users) with interest when the Postal service issues a written notice to the provider setting forth the facts and reasons on which the determination to impose the sanction is based. The notification is in writing and is sent certified mail, return receipt requested. The notice shall advise the provider of the date that the action takes effect if a written defense is not presented within 30 calendar days of receipt of the notice.

      (c) The provider may present the Postal Service with a written defense to the proposed action within 30 calendar days after receiving or refusing to receive notification. The defense must include all supporting evidence and specify the reasons for which the sanction should not be imposed.

      (d) After receipt and consideration of the defense, the Postal Service shall advise the provider of the decision and the facts and reasons for it; the decision shall be effective on receipt unless it states otherwise. The notification of the decision is in writing and is sent certified mail, return receipt requested. The decision shall also advise the provider that it may, within 30 calendar days of receiving the decision, appeal that determination as specified therein.

      (e) The provider may submit a written appeal to the Postal Service within 30 calendar days of receiving or refusing to receive notification of the decision. The appeal must include all supporting evidence and specify the reasons that the provider believes that the administrative sanction was erroneously imposed. The submission of an appeal stays the effectiveness of the sanction.

      (f) The imposition of an administrative sanction under this section does not preclude any other criminal or civil statutory, common law, or administrative remedy that is available by law to the Postal Service, the United States, or any other person or concern.

      Sec. 502.17 Materials and workmanship.

      All postage evidencing systems that generate IBI must continuously maintain the quality in materials and workmanship of the production model approved by the Postal Service.

      Sec. 502.18 Destruction of information-based indicia.

      All indicia created in the process of testing the postage evidencing system by the provider, or its agent, must be collected and securely controlled or destroyed by the provider to prevent unauthorized use.

      Sec. 502.19 Inspection of new postage evidencing systems.

      The provider shall inspect all new postage evidencing systems that generate IBI to ensure proper functioning of all operational capabilities of each system before distribution.

      Sec. 502.20 Distribution facilities.

      (a) An authorized provider must keep adequate facilities for and records of the distribution, control, maintenance, replacement, and disposal or destruction of all PSDs throughout their entire life cycle. Recordkeeping is required for all PSDs, including newly produced PSDs, active leased PSDs and inactive, unleased PSDs, as well as lost and stolen PSDs. All such facilities and records are subject to inspection by Postal Service representatives.

      (b) If the provider uses a third party to control, distribute, maintain, replace, repair, or dispose of PSDs or postage evidencing systems, all aspects of the arrangement between the parties must be specifically authorized in writing by the manager of Postage Technology Management, USPS Headquarters.

      (1) The third party relationship shall not compromise any security element of the postage evidencing system. The functions of the third party with respect to these systems are subject to the same scrutiny as the functions of the provider.

      (2) Any authorized third party must keep adequate facilities for and records of PSDs and postage evidencing systems in accordance with the USPS-authorized arrangement with the provider. All such facilities and records are subject to inspection by Postal Service representatives, in so far as they are used to control, distribute, store, maintain, replace, repair, or dispose of PSDs or postage evidencing systems.

      (3) The Postal Service holds the provider fully responsible for any deficiencies found in third party facilities, records, or procedures and can require termination of the third party arrangement if deficiencies are found.

      Sec. 502.21 Distribution controls.

      Each authorized provider must do the following:

      (a) Hold title permanently to all PSDs that print U.S. postage, except those purchased by the Postal Service.

      (b) On behalf of applicants, electronically transmit information required to apply for a user registration to the designated Postal Service central registration processing facility.

      [[Page 58693]]

      (c) On behalf of users registered to use their postage evidencing systems, forward to the Postal Service any changes to user registration information when the user submits such changes to the provider. The provider must follow authorized USPS procedures for moving the system when a registered user changes the registration post office. The provider must also notify the Postal Service following any event that indicates the need to update registered user information, such as the return of an invoice or the inability to communicate with the user.

      (d) Lease PSDs only to parties that have valid user registrations issued by the Postal Service to use a postage evidencing system.

      (e) Unless otherwise authorized by the Postal Service, immediately withdraw from service any PSD that the registered user no longer wants, or that is to be removed from service for any other reason. The provider shall retrieve any withdrawn PSD that is in the possession of the registered user. All resetting requests for a withdrawn PSD must be denied. The provider must keep in its possession for at least 1 year from the date of withdrawal a copy of the information on the registered user's PS Form 3601-C, Postage Evidencing System Activity Report.

      (f) Retrieve any misregistering, faulty, or defective PSD and withdraw it from service within 3 business days of being notified by the registered user of the defect. The provider must examine each PSD withdrawn from service for apparent faulty operation affecting the ascending or the descending register, or for other failure to record its operations correctly and accurately. After examining the withdrawn PSD, the provider must compile a written report explaining the malfunction to the manager of Postage Technology Management, USPS Headquarters. The report must include an explanation of the malfunction that resulted in the faulty operation or other failure to record operations correctly and accurately, all applicable system documentation, including log files, and a recommendation for the appropriate postage adjustment, if applicable. At the same time the report is made to the Postal Service, the provider must notify the registered user of the proposed postage adjustment. The provider may supply the registered user with a replacement PSD only if the faulty PSD is in the provider's possession.

      (g) Report promptly the loss or theft of any PSD, the recovery of any PSD previously reported as lost or stolen, or the scrapping of any PSD by the provider. The provider must notify the Postal Service by completing a standardized Lost and Stolen Postage Evidencing System Incident Report and filing it with the Postal Service by the tenth day of the month following when a PSD is scrapped or the provider determines the loss, theft, or recovery of a PSD. For lost or stolen PSDs, the provider must complete all preliminary location activities specified in Sec. 502.26 before including a given incident on this report.

      (h) Provide to the Postal Service upon request an electronic file or database of all postage evidencing systems in service, including the PSD identification number, the registered user's name and address, the date that the system was placed in service, and the ZIP Code of the registration post office. This information is to be provided to the Postal Service in USPS-specified format, at times to be determined by the Postal Service.

      (i) Keep accurate records and reconcile differences between their records and Postal Service databases.

      (j) Keep at provider's headquarters an electronic file or database with a complete record of all PSDs produced, showing all movements of each from the time that the PSD is produced until it is scrapped. The records shall be organized by PSD identification number and shall include the reading on the ascending register each time the PSD is authorized for a new registered user or is withdrawn from service. These records must be available for inspection by Postal Service officials at any time during normal business hours. The record for each PSD must be maintained for 3 years after the PSD is scrapped.

      (k) Submit other reports as required by the Postal Service.

      (l) Cancel a lease agreement with any lessee whose registration to use a postage evidencing system is revoked by the Postal Service.

      (m) Promptly withdraw from service any PSD that the Postal Service indicates should be withdrawn from service for revocation of user registration or for any other reason, and retrieve the PSD if it is in the possession of the registered user. When a user registration is revoked, the provider must retrieve all PSDs in the possession of the registered user and must withdraw from service all PSDs employed by the registered user.

      (n) Take reasonable precautions in the transportation and storage of PSDs to prevent use by unauthorized individuals. Providers must ship all PSDs by Postal Service Priority Mail unless given written permission by the Postal Service to use another method.

      (o) Communicate to all registered users of a postage evidencing system the required cautionary statements that provide the registered user with basic reminders that the postal security device is leased, the actions needed on relocation of the postage evidencing system, and warnings against system misuse.

      (1) The cautionary statements must be visually presented to the registered user upon each start-up of the postage evidencing system. The user must actively acknowledge the statements before proceeding with system use. In addition, the statements shall be included prominently in the user documentation provided with each system. PSDs that are in the possession of a user shall include the cautionary statements on a label attached to the PSD, to the housing of the PSD, or to the postage evidencing system containing the PSD, if the physical dimensions of the equipment will accommodate them. Postage evidencing systems provided to registered users without this cautionary information shall not be authorized for use.

      (2) In every presentation of the cautionary statements to the registered user, the words shown below in capital letters should be emphasized. If the cautionary statement can be placed on the PSD or other equipment, it shall be placed in a conspicuous and highly visible location. The minimum width of the text block containing the statement should be 3.25 inches, and the minimum height should be 1.75 inches. The statement shall read as follows:

      POSTAL SERVICE NOTICE

      LEASED POSTAGE EVIDENCING SYSTEM--NOT FOR SALE

      PROPERTY OF [NAME OF PROVIDER]

      Use of this system is permissible only under a U.S. Postal Service postage evidencing system user registration.

      Call [NAME OF PROVIDER] at phone number ### ###-#### to relocate or return this Postage Evidencing System.

      WARNING! POSTAGE EVIDENCING SYSTEM TAMPERING OR MISUSE IS A FEDERAL OFFENSE.

      IF YOU SUSPECT POSTAGE EVIDENCING SYSTEM TAMPERING, CALL INSPECTOR GENERAL'S HOTLINE AT 1-800-654-8896 OR YOUR LOCAL POSTAL INSPECTOR.

      REWARD UP TO $50,000 for information leading to the conviction of any person who misuses a postage evidencing system resulting in the Postal Service not receiving correct postage payments.

      (3) Exceptions to the formatting of required cautionary labeling are determined on a case-by-case basis. The manager of Postage Technology Management, USPS Headquarters, must

      [[Page 58694]]

      approve, in writing, any deviation from the standard labeling requirements.

      Sec. 502.22 Administrative sanction.

      The Postal Service holds providers responsible for the entire life cycle of their postage evidencing systems, including control, distribution, operation, maintenance, replacement, and secure disposal.

      (a) ``Postage evidencing system,'' for purposes of this section, means any system that is produced by a provider authorized under Sec. 502.5 that is not owned or leased by the Postal Service.

      (b) An authorized provider that, without just cause, fails to conduct or perform adequately any of the controls required by Sec. 502.21, to follow standardized lost and stolen incident reporting in Sec. 502.26, or to conduct the inspections required by Sec. 502.25 in a timely fashion is subject to an administrative sanction based on the investigative and administrative costs and documented revenue losses (net of any amount collected by the Postal Service from the registered user), with interest per occurrence measured from the date on which the cost and/or loss occurred, as determined by the Postal Service. Sanctions shall be based on the costs and revenue losses that result from the provider's failure to comply with these requirements.

      (c) The Postal Service may impose an administrative sanction under this section by issuing a written notice to the provider setting forth the facts and reasons on which the determination to impose the sanction is based. The notification is in writing and is sent certified mail, return receipt requested. The Postal Service shall determine all costs and losses. The notice shall advise the provider of the date that the action shall take effect if a written defense is not presented within 30 calendar days of receipt of the notice.

      (d) The provider may present to the Postal Service a written defense to the proposed action within 30 calendar days of receiving or refusing to receive the notice. The defense must include all supporting evidence and specify the reasons for which the sanction should not be imposed.

      (e) After receipt and consideration of the written defense, the Postal Service shall advise the provider of the decision and the facts and reasons for it. The decision shall be effective on receipt unless it states otherwise.

      (f) The provider may submit a written appeal of the decision within 30 calendar days of receiving or refusing to receive the decision, addressed to the manager of Postage Technology Management, USPS Headquarters. The appeal must include all supporting evidence and specify the reasons that the provider believes that the administrative sanction was erroneously imposed. The submission of an appeal stays the effectiveness of the sanction.

      (g) The imposition of an administrative sanction under this section does not preclude any other criminal or civil statutory, common law, or administrative remedy that is available by law to the Postal Service, the United States, or any other person or concern.

      Sec. 502.23 Postage evidencing system maintenance.

      (a) The provider must keep its postage evidencing systems that generate IBI in proper operating condition by maintaining or replacing them when necessary or desirable to prevent electronic failure, malfunction, expiration of the life of the battery for the clock or timer, or mechanical breakdown.

      (b) The provider must provide the registered users with modifications reflecting rate changes and must implement new rates as of the effective date for the new rates established by the Postal Service.

      Sec. 502.24 Access or changes to secure components.

      Postage evidencing system maintenance involving access or changes to secure components must be done only within a secure facility under the provider's direct control and supervision. PSDs must be withdrawn from service before any such maintenance is performed.

      Sec. 502.25 Inspection of postal security devices (PSDs) in use.

      (a) The provider must conduct an audit of each PSD at least once every 3 months in conjunction with the postage value resetting requirements in Sec. 502.27. A zero-value reset will satisfy this requirement. The PSD must have a lock-out feature that prevents use of the system if an audit is not completed in accordance with this regulation.

      (b) Postage evidencing systems that generate IBI, other than PC Postage, shall be inspected by the provider every 2 years. Registered user mail-in of indicia may substitute for the provider inspection, with Postal Service approval. The provider shall inspect or sample PC Postage products under special circumstances, as directed by the Postal Service. The Postal Service examines postage evidencing systems when warranted by special circumstances.

      Sec. 502.26 PSDs not located.

      Upon learning that one or more of its PSDs in service cannot be located, the provider must undertake reasonable and timely efforts to locate the PSD by following a series of Postal Service-specified actions designed to locate the PSDs. If these efforts are unsuccessful and a PSD is determined to be lost or stolen, the provider must notify the Postal Service in accordance with Sec. 502.21.

      (a) If a user registered to use a postage evidencing system cannot be located, the provider must, at a minimum, complete the following actions:

      (1) Call the registered user's last known telephone number.

      (2) Call directory assistance for the user's new telephone number.

      (3) Contact the registered user's local post office for current change of address information.

      (4) Contact Postage Technology Management to verify the location of the PSD and the registered user as currently maintained in Postal Service records.

      (5) Contact the rental agency responsible for the property where the registered user was located, if applicable.

      (6) Visit the registered user's last known address to see whether the building superintendent or a neighbor knows the user's new address.

      (7) Mail a certified letter with return receipt to the registered user at the last known address with the endorsement ``Forwarding and Address Correction Requested''.

      (8) If new address information is obtained during these steps, any missed or delinquent scheduled PSD audit must be completed immediately.

      (b) If a PSD is reported to be lost or stolen by the registered user, the provider must, at a minimum, complete the following actions:

      (1) Discontinue postage value downloads to the lost or stolen PSD.

      (2) Ensure that the registered user has fileda police report for a stolen PSD and that copies have been provided to the appropriate Inspection Service Contraband Postage Identification Program (CPIP) specialist.

      (3) Withhold issuance of a replacement PSD until the missing PSD has been properly reported to the police and to the appropriate Inspection Service CPIP specialist.

      (c) If the provider later learns that the PSD has been located and/ or recovered, the provider must take the following actions before returning the PSD to service or allowing a postage value download:

      (1) Submit a new Lost and Stolen Postage Evidencing System Incident

      [[Page 58695]]

      Report that references the initial report and outlines the details of how the PSD was recovered, in accordance with Sec. 502.21. The provider is responsible for keeping records of these reports as submitted to the Postal Service for a minimum of 3 years after submission.

      (2) Retrieve the recovered PSD from the registered user and examine it for apparent faulty operation that could affect its ability to record its operations correctly and result in a questionable accurate registration.

      (3) Recommend a postage adjustment or refund, if appropriate.

      (4) Withdraw the PSD from service if a replacement PSD has been supplied to the registered user or if there is an issue of questionable accurate registration.

      (d) Any authorized provider that fails to comply with standardized lost and stolen reporting procedures and instructions is subject to an administrative sanction under Sec. 502.22, as determined by the Postal Service.

      Sec. 502.27 Electronic Funds Resetting System (EFRS).

      (a) Description. A remote resetting system permits registered users to reset their PSDs at places of business and/or homes via modem or network interface. The Electronic Funds Resetting System (EFRS) is the Postal Service system that processes system resetting data for postage value downloads submitted by providers of postage evidencing systems that generate IBI. The Postal Service processes the data separately from data processed under the Computerized Meter Resetting System (CMRS), which is used for traditional postage meters.

      (b) Resetting a PSD. To reset a PSD, the registered user connects to the provider and provides specified identifying data and PSD audit data for the postage value download. Before proceeding with the transaction, the provider must verify all the data, conduct the system audit, and ascertain whether payment to the Postal Service sufficient to cover the desired postage value download was initiated by the registered user. If payment was initiated and the system audit was successful, the provider may complete the postage value download.

      (c) Payment to the Postal Service.

      (1) The only acceptable methods used for postage payments for postage evidencing systems that generate IBI are credit cards and Automated Clearinghouse (ACH) debit. The providers must publicize these payment options to all registered IBI users. When publicizing these options, the provider must provide a clear and concise description of each.

      (i) Credit Cards. The provider must offer the registered user the option to use all of the credit cards approved for use by the Postal Service for payment for postage. Each provider must receive authorization from the Postal Service to offer credit card options to registered users and must sign a vendor credit card pilot test agreement, a legal agreement with the Postal Service on credit card payment, which addresses security requirements, payment of transaction costs, reconciliation requirements, and retrieval and chargeback requests. The provider must use a certified credit card payment process approved for use by the Postal Service's designated card processor. All credit card transactions must be sent through the designated Postal Service card processor, with each provider working as an agent with the Postal Service as the merchant of record.

      (ii) ACH Debit. All ACH debit payments for postage must be electronically transferred directly from the registered user's account resident in a financial institution that is neither owned, nor controlled, nor contracted, nor arranged for by a product service provider or its affiliate. The funds must be transferred directly into an account at a financial institution designated by the Postal Service.

      (2) A registered user is required to initiate payment to the Postal Service sufficient to cover the desired postage value download contemporaneously with a download being made. The details of this payment requirement are covered in the Postage Payment Agreement.

      (3) Each provider is required to incorporate the Postage Payment Agreement into its postage evidencing system lease agreement with each registered user, as follows:

      POSTAGE PAYMENT AGREEMENT

      By signing this postage evidencing system lease agreement you agree to initiate payment for postage using either a USPS-approved credit card or ACH debit. If you use ACH debit, you agree to transfer funds directly to the Postal Service through a financial institution, as specified by the Postal Service, for the purpose of prepayment of postage. If you use a credit card, you agree to use only those credit cards approved for use for payment for postage by the Postal Service.

      You understand that the provider and its affiliates shall not hold, or contract with or otherwise arrange for any third party to hold, your funds intended for the purchase of postage. You will be bound by all terms and conditions of this Postage Payment Agreement as it may be amended periodically by the Postal Service.

      (4) The provider must require each registered user who requests a postage value download to provide the PSD identification number, the registered user account number, and the ascending and descending register readings on the PSD at the time of the request. The provider must verify that the information entered by the registered user is accurate and matches the provider's records. Providers must also verify that the registered user has initiated payment to the Postal Service sufficient to cover the postage value download requested before proceeding with the resetting transaction. Immediately following the completion of each transaction, the provider must give the user a statement documenting the transaction.

      (d) Revenue protection. The Postal Service shall conduct periodic audits and reviews of the EFRS revenue protection safeguards employed by each provider and shall reserve the right to revoke a provider's authorization if they do not meet all EFRS requirements set forth by the Postal Service. In addition, the Postal Service shall reserve the right to suspend the operation of the provider, as provided in Sec. 502.14, for any serious operational deficiency that may result in the loss of funds to the Postal Service.

      (e) Financial operation. The Postal Service shall establish a separate account at its designated financial institution to handle the funds for payment for postage received from registered users. The provider may not establish an account to handle the funds of registered users intended for the purchase of postage. Payment Technologies, Office of the Treasurer, USPS, will coordinate the implementation of the ACH debit process with the provider.

      (f) Reports. The provider must submit a daily financial transaction for each postage value download or postage refill according to established EFRS procedures. The provider must provide other reports as required by the Postal Service.

      (g) Inspection of records and facilities. The provider must make its facilities that handle the operation of the EFRS and all records about the operation of the system available for inspection by representatives of the Postal Service at all reasonable times.

      Sec. 502.28 Indicia quality assurance.

      The provider shall implement a mailpiece quality assurance program to ensure the quality and readability of the indicia and shall instruct the registered user on the submission of the required mailpieces. The registered user is required to forward a mailpiece to the provider for evaluation when the system is installed and at least once every 6

      [[Page 58696]]

      months thereafter. If the user fails to comply with this requirement, the provider must notify the user that all future postage value resettings will be denied. The provider must analyze these mailpieces for quality and readability and is required to provide guidance to the registered user to correct any deficiencies that are discovered. The provider must notify the Postal Service of all noncompliant registered users, so that the Postal Service can initiate revocation of the user's registration.

      Sec. 502.29 Refunds for postage evidencing systems that generate information-based indicia (IBI).

      The Postal Service provides refunds for readable, valid, unused postage on an unmailed envelope or label, and for any balance remaining on a PSD withdrawn from service and in the possession of the provider, in accordance with established refund procedures. Postage losses to the registered user due to system malfunctions and the refund of any non- postal fees are the responsibility of the provider. Registered users submit refund requests to the provider in accordance with Domestic Mail Manual (DMM) P014. The following procedures apply, depending on the type of refund requested:

      (a) Refund for unused postage

      (1) The provider shall acknowledge the refund request and confirm that the appropriate supporting materials have been received, including Postal Service Form 3533-PCP-X, Refund Request for Unused IBI Postage, in accordance with the requirements in DMM P014.

      (2) The provider shall scan the two-dimensional barcode in the submitted indicium, analyze the data to ensure the indicium is valid, and verify the following:

      (i) The PSD used in producing the indicium is the expected PSD.

      (ii) The unused postage is presented by the user to whom the PSD that produced the indicium is registered.

      (iii) The date of mailing shown in the indicium is not more than 10 days before the date on which the registered user mailed the indicium for refund. The date is checked by postmark.

      (iv) The human-readable data matches the corresponding data in the two-dimensional barcode.

      (v) The PSD certificate has not been revoked.

      (vi) The indicium has not been submitted before.

      (3) The provider shall submit the indicium data electronically to the Certificate Authority for verification of the digital signature.

      (4) The provider shall ensure there is no evidence that the mailpiece has been processed by the Postal Service.

      (5) The provider shall annotate Postal Service Form 3533-PCP-X, Refund Request for Unused IBI Postage, and notify both the registered user and the manager of Postage Technology Management, USPS Headquarters, of any instances where the refund request for a given, unused indicium will be denied.

      (6) Upon successful signature verification and completion of all other required checks listed above, the provider shall either:

      (i) Issue an immediate refund to the registered user from the provider's own funds, or

      (ii) Issue the refund to the registered user within 5 business days of receiving reimbursement from the Postal Service.

      (7) No more frequently than once per week, the provider shall submit to the Postal Service a refund request for unused postage, using the format in Postal Service Form PCP-X, Provider Refund Request for Information-Based Indicia.

      (8) The Postal Service shall remit a check made payable to the provider for the total amount of the refund request for unused postage.

      (9) The Postal Service reserves the right to audit the provider's refund processing and the unused mailpieces submitted for refund. Providers are required to maintain the following records:

      (i) The unused envelopes and labels submitted for refund, and any other correspondence related to the refund request, attached to a copy of the associated Form 3533 PCP-X, Refund Request for Unused IBI Postage, and organized by the date of the provider's refund request. The Postal Service will destroy the unused mailpieces after the completion of the audit.

      (ii) Electronic copies of the scanned indicia organized by date submitted for refund. These are maintained until the Postal Service completes its audit.

      (iii) Postal Service Form 3533-PCP-X (printed copy) submitted by the registered user to the provider. The printed copy shall be kept for 1 year. An electronic, scanned version with the registered user's signature shall be kept for 3 years after the destruction of the printed copy.

      (iv) A copy of each Postal Service Form PCP-X, Provider Refund Request for Information-Based Indicia, submitted by the provider to the Postal Service. This form shall be maintained by the provider until completion of the Postal Service audit.

      (v) A refund count (by number of pieces and postage amount) for each PSD. This information shall be maintained until completion of the first Postal Service audit following the withdrawal of the PSD from service.

      (b) Refund for postage balance remaining on a PSD that is withdrawn from service and is in the possession of the provider.

      (1) The registered user informs the provider of the intention to withdraw the PSD from service and has the postage evidencing system generate a refund request indicium for transmittal to the provider. The means by which this is accomplished is at the provider's discretion. The transmittal of the refund request indicium is the last activity that is permitted for the PSD. If the registered user has physical possession of the PSD, the registered user returns the withdrawn PSD to the provider, in accordance with regulations for returning PSDs.

      (2) Upon receipt of the refund request indicium and the PSD (where applicable), the provider shall scan the two-dimensional barcode in the submitted indicium, analyze the data to ensure the indicium is valid, and verify the following:

      (i) The descending register value in the refund request indicium is $0.00.

      (ii) The PSD used in producing the indicia is the expected PSD.

      (iii) The refund request indicium is presented by the registered user of the PSD.

      (iv) The PSD certificate has not been revoked.

      (v) There is no evidence of tampering with the PSD.

      (3) The provider shall submit the refund request indicium data electronically to the Certificate Authority for digital signature verification.

      (4) Under no circumstances may a provider issue a refund for a withdrawn PSD unless the PSD is in the provider's possession.

      (5) The provider shall not issue a refund if there is any question as to the remaining postage value on the PSD without first consulting with the manager of Postage Technology Management, USPS Headquarters. The provider shall notify both the registered user and the manager of Postage Technology Management of any instances where the refund request will be denied.

      (6) The provider shall generate a form equivalent to Postal Service Form 3601-C, Postage Evidencing System Activity Report, for withdrawal of the PSD. The form will include the refund request indicium.

      [[Page 58697]]

      (7) Upon successful signature verification and completion of all other required checks listed above, the provider shall initiate a PSD withdrawal as specified by Postal Service procedures and shall revoke the PSD certificate. Then the provider shall either:

      (i) Issue an immediate refund to the registered user from the provider's own funds; or

      (ii) Issue the refund to the registered user within 5 business days of receiving reimbursement from the Postal Service.

      (8) No more frequently than once per week, the provider shall submit to the Postal Service a refund request for withdrawn PSDs, including a listing of the refund requested by each registered user, using the format in Postal Service Form PCP-X, Provider Refund Request for Information-Based Indicia.

      (9) The Postal Service shall remit a check made payable to the provider for the total amount of the refund request for postage value remaining on withdrawn PSDs.

      (10) The Postal Service reserves the right to audit the provider's refund processing and the refund request indicia. Providers are required to maintain the following records:

      (i) An electronic copy of a form equivalent to Postal Service Form 3601-C, Postage Evidencing System Activity Report, which includes the refund request indicia, organized by the date of the provider's refund request, shall be kept for 2 years, or until the completion of the Postal Service audit, whichever is longer.

      (ii) Any other correspondence that is related to the refund request must be retained by the provider until the Postal Service completes its audit.

      (iii) A copy of each Postal Service Form PCP-X, Provider Refund Request for Information-Based Indicia, submitted by the provider to the Postal Service shall be maintained by the provider until completion of the Postal Service audit.

      Sec. 502.30 Registered user information.

      (a) Providers are required to collect registration information and transaction records from registered users on behalf of the Postal Service and to transmit the data to the Postal Service as part of the registration process, the postage payment process; and, for IBI open systems, the mailpiece generation process. Although the Postal Service does not require the provider to retain registered user information, the provider may choose to do so for its own purposes, subject to the following limitations:

      (1) A provider that retains personal information regarding a registered user must issue a privacy policy that informs the registered user of the information to be retained and its intended uses.

      (2) The provider is strictly prohibited from disclosing any list of applicants or registered users, or any identifying information about any given applicant or registered user, to any other entity, for any purpose, without prior notification to the customer.

      (3) The provider must offer the applicant or registered user the option to not have their personal information disclosed to any other entity.

      (b) As stated in Sec. 502.21, providers are required to electronically transmit information required to apply for a user registration to the designated Postal Service central registration processing facility, on behalf of applicants.

      (c) The Postal Service shall use the registered user information in accordance with the purposes and routine uses published in the Privacy Act system of records USPS 140.020, Postage-Postage Evidencing System Records. The Postal Service may use applicant information in the administration of postage evidencing systems and mailing activities, and to communicate with customers who may no longer be visiting a traditional USPS retail outlet. The Postal Service will also use applicant information to communicate with USPS customers through any new retail channels, and for the following purposes:

      (1) To issue (including reregistration, renewal, transfer, revocation, or refusal, as applicable) a user registration to a customer and to communicate with respect to the status of such registration.

      (2) To disclose to a provider the identity of any PSD and any related user registration data for any PSDs required to be removed from service by that provider as the result of revocation of a user registration, questioned accurate registration or other failure of the PSD to record its operations correctly and accurately, or decertification by the Postal Service of any particular postage evidencing system that generates IBI or family of such models.

      (3) To track the movement of postage evidencing systems between a provider and registered users and to communicate to a provider (but not to any third party other than the applicant/registered user) concerning such movement. The term ``provider'' includes a provider's dealers and agents.

      (4) To transmit general information to all registered users concerning rate and rate category changes implemented or proposed for implementation by the Postal Service.

      (5) To advertise Postal Service services relating to the acceptance, processing and delivery of or postage payment for mail using information-based indicia.

      (6) To allow the Postal Service to communicate with USPS customers on products, services, and other information otherwise available to USPS customers through traditional retail outlets.

      (7) To support any internal use by Postal Service personnel, including identification and monitoring activities relating to postage evidencing systems, provided that such use by the Postal Service does not result in the disclosure of applicant information to any third party and will not enable any third party to use applicant information for its own purposes; except that the applicant information may be disclosed to other governmental agencies for law enforcement purposes as provided by law.

      (8) To identify authorized product service providers or announce de-authorization of an authorized product service provider, or provide currently available public information, where an authorized provider is identified.

      (9) To promote and encourage the use of information-based indicia as a form of postage evidencing, provided that the same information is provided to all registered users, and no particular provider will be recommended by the Postal Service.

      (10) To contact registered users in cases of revenue fraud or revenue security, except that any registered user suspected of fraud shall not be identified to other users.

      (11) To disclose to a provider applicant information pertaining to that provider's customers that the Postal Service views as necessary to enable the Postal Service to carry out its duties and purposes.

      (12) To transmit to a provider all applicant and system information pertaining to that provider's customers and systems that may be necessary to permit such provider to synchronize its registered user and PSD database with information contained in the computer files of the Postal Service, including but not limited to computerized data that reside in Postal Service postage evidencing system management databases.

      (13) Subject to the conditions stated herein, to communicate in oral or written form with any or all applicants and registered users any information that the Postal Service views as necessary or desirable to enable the Postal Service to carry out its duties and purposes under this part 502.

      [[Page 58698]]

      Sec. 502.31 Intellectual Property

      (a) None of the following shall constitute a grant of authorization or consent by the Postal Service or the United States to a provider or any other person to manufacture or use any patented invention or to infringe any copyright, under 28 U.S.C. 1498 or otherwise:

      (1) The publication of performance criteria, or

      (2) The granting of authorization to a provider under part 501 or this part 502, or

      (3) The granting of approval to a provider to market or distribute a postage evidencing system.

      (b) A provider must reimburse the Postal Service for any compensation or other costs or damages (other than the Postal Services' own attorneys' fees and other costs of defense) that the Postal Service or the U.S. Government is required, by final order of a court of competent jurisdiction which is either not subject to appeal or as to which the time to appeal has already passed, to pay on a claim of infringement or unauthorized use of a U.S. patent or U.S. copyright, under any legal theory, based on either:

      (1) The manufacture, use, sale or importation of provider's postage evidencing system, whether or not such manufacture, use, sale or importation is alleged to be pursuant to authorization or consent provided under 28 U.S.C. 1498;

      (2) The use of provider's postage evidencing system by mailers in a manner specified or intended by Provider to create postage indicia, apply such indicia to mail, and/or deposit such mail with the USPS; or

      (3) The granting by the Postal Service to provider of government authorization or consent, under 28 U.S.C. 1498 or otherwise, to make or use a patented invention or infringe a copyright in connection with the manufacture, use or sale of provider's postage evidencing system, or the activities of provider pursuant to such grant of authorization and consent.

      (c) The Postal Service may suspend approval of a postage evidencing system on 60 days' notice to provider if a court of competent jurisdiction determines that the manufacture or use of the postage evidencing system, or the creation or validation of the indicia produced thereby, infringes, induces or contributes to the infringement of, or otherwise violates any person's or entity's rights under a U.S. patent or U.S. copyright. The Postal Service shall reinstate approval of such postage evidencing system if and so long as:

      (1) Such judicial determination is vacated or reversed; or

      (2) The provider duly licenses or otherwise procures and maintains in effect (for the benefit of itself, users and the Postal Service as may be necessary) the right to conduct, with respect to provider's postage evidencing device and the indicia created thereby, the activities that the court has determined to be infringing.

      (d) A determination that the validating of an indicia by the Postal Service infringes a patent or copyright shall not be a basis for suspending provider's approval if the provider can establish that alternative, non-infringing means of performing such validation are available to the Postal Service with respect to the indicia created by provider's postage evidencing device so long as such means fully comply with the performance criteria under which the postage evidencing device and indicia have been approved.

      (e) The Postal Service may provide additional requirements relating to intellectual property in the product submission procedure, performance criteria or both (``IP Requirements'') and may condition the granting or maintenance of approval of a postage evidencing system on provider's compliance with those IP Requirements. When IP Requirements are imposed on a provider, they shall control over any conflicting provision in this Sec. 502.31.

      (f) The requirements of this Sec. 502.31 shall apply to all aspects of a provider's postage evidencing device and the indicia created thereby, including those aspects required or specified under applicable performance criteria.

      (g) Notwithstanding Sec. 502.1 to the contrary, this Sec. 502.31 shall apply to any postage evidencing system approved by the Postal Service under part 501, part 502 or otherwise and to any performance criteria whether directed to IBI or other forms of postage evidence.

      Appropriate amendments to 39 CFR parts 111 and 502 to reflect these changes will be published if the proposal is adopted.

      Stanley F. Mires, Chief Counsel, Legislative.

      [FR Doc. 00-25090Filed9-29-00; 8:45 am]

      BILLING CODE 7710-12-U