S. 3023

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 3023 Engrossed in Senate (ES)]

<DOC>

119th CONGRESS
2d Session
S. 3023

_______________________________________________________________________

AN ACT

To limit liability for certain entities storing child sexual abuse 
material for law enforcement agencies, and for other purposes.

Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the ``Safe Cloud Storage Act''.

SEC. 2. STORAGE OF CHILD PORNOGRAPHY, CHILD OBSCENITY, AND INTIMATE 
VISUAL DEPICTIONS OF MINORS.

(a) In General.--Title II of the PROTECT Our Children Act of 2008 
(34 U.S.C. 21101 et seq.) is amended by inserting after section 201 the 
following:

``SEC. 202. MODERNIZING LAW ENFORCEMENT'S ABILITY TO STORE CHILD 
PORNOGRAPHY, CHILD OBSCENITY, AND INTIMATE VISUAL 
DEPICTIONS OF MINORS AND LIMITED LIABILITY FOR APPROVED 
VENDORS.

``(a) Definitions.--In this section:
``(1) Approved vendor.--The term `approved vendor' means a 
cloud service provider that--
``(A) complies with the security requirements 
described in subsection (c); and
``(B) has been contractually retained by a covered 
agency to support the duties of such agency by--
``(i) storing digital child pornography, 
child obscenity, or an intimate visual 
depiction of a minor;
``(ii) making such child pornography, child 
obscenity, or intimate visual depiction of a 
minor available to the contracting agency, or 
any law enforcement or prosecutorial agency 
designated by the contracting agency, upon 
request; and
``(iii) providing maintenance, technical 
and analytical assistance, and forensic tool 
processing support upon request by the 
contracting agency.
``(2) Child pornography.--The term `child pornography' has 
the meaning given that term in section 2256(8) of title 18, 
United States Code.
``(3) Cloud service provider.--The term `cloud service 
provider' means an organization, corporation, or entity that 
makes available digital storage services, including remote or 
cloud-based storage, and analytical and forensic tool 
processing support.
``(4) Covered agency.--The term `covered agency' means a 
Federal, State, or local law enforcement or prosecutorial 
agency.
``(5) Intimate visual depiction of a minor.--The term 
`intimate visual depiction of a minor' means an intimate visual 
depiction, as defined in section 223(h) of the Communications 
Act of 1934 (47 U.S.C. 223(h)), including a digital forgery, of 
an identifiable individual who is a minor, as that term is 
defined in such section.
``(6) Local.--The term `local' means any political 
subdivision of a State.
``(7) State.--The term `State' means any of the 50 States 
of the United States, the District of Columbia, the 
Commonwealth of Puerto Rico, the Virgin Islands of the United 
States, Guam, American Samoa, or the Commonwealth of the 
Northern Mariana Islands.
``(b) Limited Liability for Approved Vendors.--
``(1) Limited liability for law enforcement approved 
vendors.--Except as provided in paragraph (2), a civil claim or 
criminal charge may not be brought in any Federal or State 
court against an approved vendor relating to the approved 
vendor's performance of any contractual obligation or service 
described in subsection (a)(1).
``(2) Intentional, reckless, or other misconduct.--A civil 
claim or criminal charge may be brought in any Federal or State 
court against an approved vendor if the approved vendor--
``(A) engaged in--
``(i) intentional misconduct; or
``(ii) negligent conduct; or
``(B) acted, or failed to act--
``(i) with actual malice;
``(ii) with reckless disregard to a 
substantial risk of causing injury without 
legal justification; or
``(iii) for a purpose unrelated to the 
performance of any responsibility or function 
described in subsection (a)(1)(B).
``(c) Vendor Cybersecurity Requirements.--With respect to any child 
pornography, child obscenity, or intimate visual depiction of a minor 
stored, maintained, or processed by an approved vendor, such approved 
vendor shall--
``(1) secure such child pornography, child obscenity, or 
intimate visual depiction of a minor in a manner that is 
consistent with the most recent version of the Cybersecurity 
Framework developed by the National Institute of Standards and 
Technology, or any successor thereto;
``(2) only access the child pornography, child obscenity, 
or intimate visual depiction of a minor upon consent of the 
covered agency contracting the service and for the purpose of 
providing maintenance, technical assistance, and forensic tool 
processing support in the cloud;
``(3) minimize the number of employees that may be able to 
obtain access to such child pornography, child obscenity, or 
intimate visual depiction of a minor and maintain a list of 
employees who have obtained such access;
``(4) employ end-to-end encryption for data storage and 
transfer functions, or an equivalent technological standard;
``(5) undergo an independent annual cybersecurity audit to 
determine whether such child pornography, child obscenity, or 
intimate visual depiction of a minor is secured as required by 
paragraphs (1), (3), and (4), including by assessing compliance 
with the National Institute of Standards and Technology Special 
Publication 800-53, Revision 5 (relating to security and 
privacy controls for information systems and organizations) or 
any successor documents or revisions; and
``(6) promptly address all issues identified by an audit 
described in paragraph (5).
``(d) Evidence Storage.--Any covered agency that stores child 
pornography, child obscenity, or an intimate visual depiction of a 
minor pursuant to a contract with an approved vendor shall retain such 
evidence--
``(1) in compliance with the security policy of the 
Criminal Justice Information Services Division of the Federal 
Bureau of Investigation, or any other similar and appropriate 
division within the Federal Bureau of Investigation;
``(2) for a period consistent with the evidence retention 
requirements applicable to the covered agency under the 
relevant Federal, State, or local law, rule of criminal 
procedure, or prosecutorial policy; or
``(3) in the absence of such law, rule, or policy, for a 
period not less than the applicable statute of limitations or 
the duration of any sentence imposed, including the period of 
post-conviction review.
``(e) Additional Requirements for Approved Vendors.--
``(1) Location of data.--
``(A) In general.--Except as provided in 
subparagraph (B), each approved vendor shall ensure 
that any child pornography, child obscenity, or 
intimate visual depiction of a minor stored pursuant to 
this section remains in the United States.
``(B) Exception.--Child pornography, child 
obscenity, and intimate visual depictions of a minor 
stored under this section may be transferred outside 
the United States only with the express consent of the 
contracting covered agency if such agency deems the 
transfer necessary for investigative purposes.
``(2) Notification letter.--
``(A) In general.--Approved vendors shall file a 
notification letter with the Criminal Division of the 
Department of Justice not later than 30 days after 
entering into a contract described in subsection 
(a)(1)(B).
``(B) Contents.--The notification letter described 
in subparagraph (A) shall include the entity name and 
point of contact information of the approved vendor, 
the name of the contracting covered agency, the period 
of performance of the contract, and an acknowledgment 
by the approved vendor that the approved vendor will 
notify the Child Exploitation and Obscenity Section of 
the Criminal Division of the Department of Justice of 
any changes to the information in the letter.
``(3) Breach of contract.--
``(A) In general.--If a covered agency fails to 
make required payment under a contract, breaches any 
material term of such contract, or otherwise terminates 
such contract without establishing lawful transfer of 
the evidence, the approved vendor shall, not later than 
30 days after the failure, breach, or termination, 
notify the Criminal Division of the Department of 
Justice in the case of a breach by a Federal agency, or 
the appropriate State attorney general in the case of a 
breach by a State or local agency.
``(B) Maintenance of evidence.--Upon making a 
notification under subparagraph (A), the approved 
vendor shall continue to preserve and maintain the 
integrity of the evidence until a prompt and lawful 
transfer of custody occurs to the Criminal Division of 
the Department of Justice or another Federal, State, or 
local law enforcement agency with jurisdiction.
``(f) Rule of Construction.--Nothing in this section shall be 
construed to limit--
``(1) bona fide use by the contracting covered agency of 
child pornography, child obscenity, or intimate visual 
depiction of a minor being stored by the approved vendor, which 
includes providing such child pornography or child obscenity to 
any other party as necessary for an investigation or 
prosecution; or
``(2) the obligation of the contracting covered agency to 
comply with a constitutional or statutory obligation, court 
order, or request from a victim made pursuant to section 
3509(m)(3) of title 18, United States Code.''.
(b) Clerical Amendment.--Section 1(b) of the PROTECT Our Children 
Act of 2008 (Public Law 110-401; 122 Stat. 4229) is amended by 
inserting after the item relating to section 201 the following:

``Sec. 202. Modernizing law enforcement's ability to store child 
pornography, child obscenity, and intimate 
visual depictions of minors and limited 
liability for approved vendors.''.

Passed the Senate May 20, 2026.

Attest:

Secretary.
119th CONGRESS

2d Session

S. 3023

_______________________________________________________________________

AN ACT

To limit liability for certain entities storing child sexual abuse 
material for law enforcement agencies, and for other purposes.