The bill aims to amend the PROTECT Our Children Act of 2008 to modernize law enforcement's ability to store child pornography, child obscenity, and intimate visual depictions of minors by utilizing approved cloud service providers. It outlines definitions for terms related to child pornography and cloud service providers and specifies limited liability for approved vendors, cybersecurity requirements, evidence storage, and additional requirements for approved vendors. The bill also requires approved vendors to keep data within the United States, file a notification letter with the Department of Justice, and address breaches of contract. It includes a rule of construction to ensure compliance with constitutional and statutory obligations and court orders.
Safe Cloud Storage Act
This bill limits the civil and criminal liability of vendors that contract with law enforcement agencies to provide digital storage services (e.g., remote or cloud-based storage) for storing, maintaining, and processing child sexual abuse material (CSAM) in investigations of online child sexual exploitation.
Under current law, the National Center for Missing & Exploited Children (NCMEC) receives reports of online child sexual exploitation via its CyberTipline, evaluates and prioritizes the reports, and refers the reports to law enforcement agencies to investigate. Currently, federal law limits the liability of vendors that contract directly with the NCMEC to store and transfer CSAM. However, federal law does not limit the liability of vendors that contract with law enforcement agencies to assist in investigations.
This bill establishes liability protections for vendors that contract with federal, state, and local law enforcement agencies to store, maintain, and process CSAM in investigations of online child sexual exploitation. Specifically, the bill prohibits a civil claim or criminal charge in federal or state court against such a vendor, so long as the vendor has not engaged in intentional misconduct or negligent conduct, acted with malice or reckless disregard, or acted for a purpose unrelated to its contractual duties.
The bill requires vendors to comply with cybersecurity requirements for CSAM that is stored, maintained, or processed. The bill also requires vendors to comply with storage requirements for CSAM that is retained as evidence.
