Safe Cloud Storage Act

This section states that the Act may be cited as the Safe Cloud Storage Act.

This section would insert a new section 202 into Title II of the PROTECT Our Children Act of 2008 (34 U.S.C. 21101 et seq.) and would add a matching table-of-contents entry for that new section. The inserted section 202 would work as follows.

It defines an approved vendor as an organization, corporation, or entity that both (1) offers digital storage services, including remote or cloud-based storage, and analytical and forensic tool processing support, and (2) has been contractually retained and designated by a United States law enforcement or prosecutorial agency to support that agency's duties by storing digital child pornography or child obscenity, making that material available on request to the contracting agency or to any other law enforcement or prosecutorial agency the contracting agency designates, and providing maintenance, technical and analytical assistance, and forensic tool processing support on the contracting agency's request. Both parts of that definition must be met. Child pornography would carry the meaning already given to that term in section 2256 of title 18, United States Code.

Limited liability: except as described in the next sentence, no civil claim or criminal charge could be brought against an approved vendor in any federal or state court over the vendor's performance of the contracted storage, access, or support services described above. That protection would not apply, and a civil claim or criminal charge could be brought, if the approved vendor engaged in intentional misconduct or negligent conduct, or acted (or failed to act) with actual malice, with reckless disregard of a substantial risk of causing injury without legal justification, or for a purpose unrelated to performing the contracted responsibilities described above.

Vendor cybersecurity requirements: for any visual depiction an approved vendor stores and makes available for analysis in its cloud storage service, in connection with a law enforcement investigation of the sexual exploitation of children, the vendor would have to secure the depiction consistent with the most recent version of the Cybersecurity Framework developed by the National Institute of Standards and Technology (or any successor framework); access the depiction only with the consent of the contracting law enforcement or prosecutorial agency and only to provide maintenance, technical assistance, or forensic tool processing support in the cloud; minimize the number of employees who can access it; use end-to-end encryption, or an equivalent technical standard, for storing and transferring the data; undergo an independent cybersecurity audit every year to check whether the depiction is secured as required; and promptly address any problems the audit identifies.

Evidence storage by the agency: a law enforcement or prosecutorial agency that stores evidence of child pornography or child obscenity using cloud-based or remote storage services would have to keep that evidence in compliance with the security policy of the FBI's Criminal Justice Information Services, and would have to retain it for whatever period the applicable federal, state, or local law, rule of criminal procedure, or prosecutorial policy requires. If no such law, rule, or policy sets a retention period, the agency would instead have to keep the evidence for at least as long as the applicable statute of limitations or for the duration of any sentence imposed, including any period of post-conviction review.

Additional requirements for approved vendors: each approved vendor would have to ensure that all cloud-based storage and analytics of the child pornography or child obscenity under this section stay within the United States. Not later than 30 days after entering into a qualifying contract, the vendor would have to file a notification letter with the Department of Justice giving the vendor's name and point of contact information, the contracting agency's name, the contract's period of performance, and the vendor's acknowledgment that it will notify the Department of Justice of any later changes to that information. If the contracting law enforcement or prosecutorial agency fails to make a required payment under the contract, breaches any material contract term, or otherwise terminates the contract without establishing a lawful transfer of the evidence, the vendor would have to notify the Department of Justice, or, if the contracting agency is a state or local agency, the appropriate state attorney general, within 30 days of that failure, breach, or termination. After giving that notice, the vendor would have to keep preserving and maintaining the integrity of the evidence until lawful custody transfers to the Department of Justice or to another federal, state, or local law enforcement agency with jurisdiction.

Separately, this section would amend the table of contents of the PROTECT Our Children Act of 2008 to add the title of the new section 202, a clerical update with no substantive effect of its own.