S 3023
Safe Cloud Storage Act
Take action
Record your position on this measure.
Sign in to record your position, submit testimony, or contact your legislator.
Sign in to take action- Introduced
- Passed Senate
- Passed House
- To President
- Became Law
Bill overview
The Safe Cloud Storage Act aims to modernize law enforcement’s ability to store child sexual abuse material by establishing a framework for using approved cloud storage vendors. It provides limited liability for these vendors who contract with law enforcement agencies to store and manage such material, subject to certain misconduct exceptions. The bill also includes cybersecurity requirements for these vendors and establishes procedures for evidence retention and notification to the Department of Justice.
Key provisions
- Defines ‘approved vendor’ as an organization storing digital child pornography or obscenity for law enforcement.
- Provides limited liability for approved vendors, except in cases of intentional misconduct or reckless disregard.
- Establishes cybersecurity requirements for approved vendors, including encryption and annual audits.
- Requires law enforcement agencies to retain evidence of child pornography and obscenity for a specified period.
- Mandates that cloud-based storage of this material remain within the United States.
- Requires approved vendors to notify the Department of Justice upon contract entry.
- Outlines procedures for breach notification and evidence preservation by vendors.
- References and amends the PROTECT Our Children Act of 2008.
Who is affected
- Law enforcement agencies
- Prosecutorial agencies
- Cloud storage vendors
- The Department of Justice
- Individuals involved in the exploitation of children
Sponsors
Official sponsors from legislative records.
Primary sponsor
Cosponsors
Arguments in favor
Reasons to support this legislation.
No arguments in favor have been submitted.
Submit yoursArguments opposed
Reasons to oppose this legislation.
No arguments opposed have been submitted.
Submit yoursRead the latest version inline or switch to a previous version.
119th CONGRESS — 1st Session
S. 3023
IN THE SENATE OF THE UNITED STATES
A BILL
To limit liability for certain entities storing child sexual abuse material for law enforcement agencies, and for other purposes.
This Act may be cited as the Safe Cloud Storage Act
.
In this section:
offers digital storage services, including remote or cloud-based storage, and analytical and forensic tool processing support; and
has been contractually retained and designated by a law enforcement or prosecutorial agency based in the United States to support the duties of such agency by—
storing digital child pornography or child obscenity;
The term child pornography has the meaning given that term in section 2256 of title 18, United States Code.
Except as provided in paragraph (2), a civil claim or criminal charge may not be brought in any Federal or State court against an approved vendor relating to the approved vendor's performance of any contractual obligation or service described in subsection (a)(1).
A civil claim or criminal charge may be brought in any Federal or State court against an approved vendor if the approved vendor—
intentional misconduct; or
negligent conduct;
acted, or failed to act—
with actual malice;
with reckless disregard to a substantial risk of causing injury without legal justification; or
for a purpose unrelated to the performance of any responsibility or function described in subsection (a)(1)(B).
With respect to any visual depiction stored and available for analysis in the cloud storage service of an approved vendor, and pursuant to the duties of law enforcement in the investigation of the sexual exploitation of children, an approved vendor shall—
secure such visual depiction in a manner that is consistent with the most recent version of the Cybersecurity Framework developed by the National Institute of Standards and Technology, or any successor thereto;
only access the visual depictions upon consent of the law enforcement or prosecutorial agency contracting the service and for the purpose of providing maintenance, technical assistance, and forensic tool processing support in the cloud;
minimize the number of employees that may be able to obtain access to such visual depiction;
employ end-to-end encryption for data storage and transfer functions, or an equivalent technological standard;
undergo an independent annual cybersecurity audit to determine whether such visual depiction is secured as required under paragraph (1); and
promptly address all issues identified by an audit described in paragraph (5).
Any law enforcement or prosecutorial agency that stores evidence of child pornography and child obscenity using cloud-based or remote storage services shall retain such evidence—
in compliance with the security policy of the Criminal Justice Information Services of the Federal Bureau of Investigation;
for a period consistent with the evidence retention requirements applicable to the investigating or prosecuting agency under the relevant Federal, State, or local law, rule of criminal procedure, or prosecutorial policy; or
in the absence of such law, rule, or policy, for a period not less than the applicable statute of limitations or the duration of any sentence imposed, including the period of post-conviction review.
Each approved vendor shall ensure that cloud-based storage and analytics of child pornography and child obscenity under this section remain in the United States.
Upon making a notification under subparagraph (A), the approved vendor shall continue to preserve and maintain the integrity of the evidence until a lawful transfer of custody occurs to the Department of Justice or another Federal, State, or local law enforcement agency with jurisdiction.
Section 1(b) of the PROTECT Our Children Act of 2008 (Public Law 110–401; 122 Stat. 4229) is amended by inserting after the item relating to section 201 the following: