Introduced in Senate

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 3023 Introduced in Senate (IS)]

<DOC>

119th CONGRESS
  1st Session
                                S. 3023

  To limit liability for certain entities storing child sexual abuse
     material for law enforcement agencies, and for other purposes.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                            October 21, 2025

    Mrs. Blackburn (for herself, Ms. Klobuchar, Mr. Cornyn, and Mr.
  Blumenthal) introduced the following bill; which was read twice and
               referred to the Committee on the Judiciary

_______________________________________________________________________

                                 A BILL

  To limit liability for certain entities storing child sexual abuse
     material for law enforcement agencies, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Safe Cloud Storage Act''.

SEC. 2. STORAGE OF CHILD SEXUAL ABUSE MATERIAL.

SEC. 2. STORAGE OF CHILD SEXUAL ABUSE MATERIAL.

    (a) In General.--Title II of the PROTECT Our Children Act of 2008
(34 U.S.C. 21101 et seq.) is amended by inserting after section 201 the
following:

``SEC. 202. MODERNIZING LAW ENFORCEMENT'S ABILITY TO STORE CHILD
              PORNOGRAPHY AND CHILD OBSCENITY AND LIMITED LIABILITY FOR
              APPROVED VENDORS.

    ``(a) Definitions.--In this section:
            ``(1) Approved vendor.--The term `approved vendor' means an
        organization, corporation, or entity that--
                    ``(A) offers digital storage services, including
                remote or cloud-based storage, and analytical and
                forensic tool processing support; and
                    ``(B) has been contractually retained and
                designated by a law enforcement or prosecutorial agency
                based in the United States to support the duties of
                such agency by--
                            ``(i) storing digital child pornography or
                        child obscenity;
                            ``(ii) making such child pornography or
                        child obscenity available to the contracting
                        agency, or any law enforcement or prosecutorial
                        agency designated by the contracting agency,
                        upon request; and
                            ``(iii) providing maintenance, technical
                        and analytical assistance, and forensic tool
                        processing support upon request by the
                        contracting agency.
            ``(2) Child pornography.--The term `child pornography' has
        the meaning given that term in section 2256 of title 18, United
        States Code.
    ``(b) Limited Liability for Approved Vendors.--
            ``(1) Limited liability for law enforcement approved
        vendors.--Except as provided in paragraph (2), a civil claim or
        criminal charge may not be brought in any Federal or State
        court against an approved vendor relating to the approved
        vendor's performance of any contractual obligation or service
        described in subsection (a)(1).
            ``(2) Intentional, reckless, or other misconduct.--A civil
        claim or criminal charge may be brought in any Federal or State
        court against an approved vendor if the approved vendor--
                    ``(A) engaged in--
                            ``(i) intentional misconduct; or
                            ``(ii) negligent conduct;
                    ``(B) acted, or failed to act--
                            ``(i) with actual malice;
                            ``(ii) with reckless disregard to a
                        substantial risk of causing injury without
                        legal justification; or
                            ``(iii) for a purpose unrelated to the
                        performance of any responsibility or function
                        described in subsection (a)(1)(B).
    ``(c) Vendor Cybersecurity Requirements.--With respect to any
visual depiction stored and available for analysis in the cloud storage
service of an approved vendor, and pursuant to the duties of law
enforcement in the investigation of the sexual exploitation of
children, an approved vendor shall--
            ``(1) secure such visual depiction in a manner that is
        consistent with the most recent version of the Cybersecurity
        Framework developed by the National Institute of Standards and
        Technology, or any successor thereto;
            ``(2) only access the visual depictions upon consent of the
        law enforcement or prosecutorial agency contracting the service
        and for the purpose of providing maintenance, technical
        assistance, and forensic tool processing support in the cloud;
            ``(3) minimize the number of employees that may be able to
        obtain access to such visual depiction;
            ``(4) employ end-to-end encryption for data storage and
        transfer functions, or an equivalent technological standard;
            ``(5) undergo an independent annual cybersecurity audit to
        determine whether such visual depiction is secured as required
        under paragraph (1); and
            ``(6) promptly address all issues identified by an audit
        described in paragraph (5).
    ``(d) Evidence Storage.--Any law enforcement or prosecutorial
agency that stores evidence of child pornography and child obscenity
using cloud-based or remote storage services shall retain such
evidence--
            ``(1) in compliance with the security policy of the
        Criminal Justice Information Services of the Federal Bureau of
        Investigation;
            ``(2) for a period consistent with the evidence retention
        requirements applicable to the investigating or prosecuting
        agency under the relevant Federal, State, or local law, rule of

criminal procedure, or prosecutorial policy; or
            ``(3) in the absence of such law, rule, or policy, for a
        period not less than the applicable statute of limitations or
        the duration of any sentence imposed, including the period of
        post-conviction review.
    ``(e) Additional Requirements for Approved Vendors.--
            ``(1) In general.--Each approved vendor shall ensure that
        cloud-based storage and analytics of child pornography and
        child obscenity under this section remain in the United States.
            ``(2) Notification letter.--
                    ``(A) In general.--Approved vendors shall file a
                notification letter with the Department of Justice not
                later than 30 days after entering into a contract
                described in subsection (a)(1)(B).
                    ``(B) Contents.--The notification letter shall
                include the entity name and point of contact
                information of the approved vendor, the name of the
                contracting agency, the period of performance of the
                contract, and an acknowledgment by the approved vendor
                that the approved vendor will notify the Department of
                Justice of any changes to the information in the
                letter.
            ``(3) Breach of contract.--
                    ``(A) In general.--If a law enforcement or
                prosecutorial agency fails to make required payment
                under a contract, breaches any material term of such
                contract, or otherwise terminates such contract without
                establishing lawful transfer of the evidence, the
                approved vendor shall, not later than 30 days after the
                failure, breach, or termination, notify the Department
                of Justice, or in the case of a State or local agency,
                the appropriate State attorney general.
                    ``(B) Maintenance of evidence.--Upon making a
                notification under subparagraph (A), the approved
                vendor shall continue to preserve and maintain the
                integrity of the evidence until a lawful transfer of
                custody occurs to the Department of Justice or another
                Federal, State, or local law enforcement agency with
                jurisdiction.''.
    (b) Clerical Amendment.--Section 1(b) of the PROTECT Our Children
Act of 2008 (Public Law 110-401; 122 Stat. 4229) is amended by
inserting after the item relating to section 201 the following:

``Sec. 202. Modernizing law enforcement's ability to store child
                            pornography and child obscenity and limited
                            liability for approved vendors.''.
                                 <all>