,,ii ,calendar ,no4 #cde #aaith ,,congress #b;d ,session ,s4 #cjbc ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,october #ba1 #bjbe,mrs4 ,blackburn 7for herself1 ,ms4 ,klobuchar1 ,mr4 ,cornyn1 ,mr4 ,blumenthal1 ,mrs4 ,britt1 ,mr4 ,coons1 ,mr4 ,lee1 and ,mrs4 ,moody7 introduced the following bill2 which was read twice and referred to the ,committee on the ,judiciary ,february #bd1 #bjbf,reported by ,mr4 ,grassley1 with an amendment,strike out all after the enacting clause and insert the part printed in italic ,a ,,bill ,to limit liability for certain entities storing child sexual abuse material for law enforcement agencies1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,safe ,cloud ,storage ,act4 #b4 ,storage of child sexual abuse material 7a7 ,in general ,title ,,ii of the ,,protect ,our ,children ,act of #bjjh 7#cd ,u4,s4,c4 #baaja et seq47 is amended by inserting after section #bja the following3 #bjb4 ,modernizing law enforcement's ability to store child pornography and child obscenity and limited liability for approved vendors 7a7 ,definitions ,in this section3 7#a7 ,approved vendor ,the term approved vendor means an organization1 corporation1 or entity that-- 7,a7 offers digital storage services1 including remote or cloud-based storage1 and analytical and forensic tool processing support2 and 7,b7 has been contractually retained and designated by a law enforcement or prosecutorial agency based in the ,united ,states to support the duties of such agency by-- 7i7 storing digital child pornography or child obscenity2 7ii7 making such child pornography or child obscenity available to the contracting agency1 or any law enforcement or prosecutorial agency designated by the contracting agency1 upon request2 and 7iii7 providing maintenance1 technical and analytical assistance1 and forensic tool processing support upon request by the contracting agency4 7#b7 ,child pornography ,the term child pornography has the meaning given that term in section #bbef of title #ah1 ,united ,states ,code4 7b7 ,limited liability for approved vendors 7#a7 ,limited liability for law enforcement approved vendors ,except as provided in paragraph 7#b71 a civil claim or criminal charge may not be brought in any ,federal or ,state court against an approved vendor relating to the approved vendor's performance of any contractual obligation or service described in subsection 7a77#a74 7#b7 ,intentional1 reckless1 or other misconduct ,a civil claim or criminal charge may be brought in any ,federal or ,state court against an approved vendor if the approved vendor-- 7,a7 engaged in-- 7i7 intentional misconduct2 or 7ii7 negligent conduct2 7,b7 acted1 or failed to act-- 7i7 with actual malice2 7ii7 with reckless disregard to a substantial risk of causing injury without legal justification2 or 7iii7 for a purpose unrelated to the performance of any responsibility or function described in subsection 7a77#a77;,b74 7c7 ,vendor cybersecurity requirements ,with respect to any visual depiction stored and available for analysis in the cloud storage service of an approved vendor1 and pursuant to the duties of law enforcement in the investigation of the sexual exploitation of children1 an approved vendor shall-- 7#a7 secure such visual depiction in a manner that is consistent with the most recent version of the ,cybersecurity ,framework developed by the ,national ,institute of ,standards and ,technology1 or any successor thereto2 7#b7 only access the visual depictions upon consent of the law enforcement or prosecutorial agency contracting the service and for the purpose of providing maintenance1 technical assistance1 and forensic tool processing support in the cloud2 7#c7 minimize the number of employees that may be able to obtain access to such visual depiction2 7#d7 employ end-to-end encryption for data storage and transfer functions1 or an equivalent technological standard2 7#e7 undergo an independent annual cybersecurity audit to determine whether such visual depiction is secured as required under paragraph 7#a72 and 7#f7 promptly address all issues identified by an audit described in paragraph 7#e74 7d7 ,evidence storage ,any law enforcement or prosecutorial agency that stores evidence of child pornography and child obscenity using cloud-based or remote storage services shall retain such evidence-- 7#a7 in compliance with the security policy of the ,criminal ,justice ,information ,services of the ,federal ,bureau of ,investigation2 7#b7 for a period consistent with the evidence retention requirements applicable to the investigating or prosecuting agency under the relevant ,federal1 ,state1 or local law1 rule of criminal procedure1 or prosecutorial policy2 or 7#c7 in the absence of such law1 rule1 or policy1 for a period not less than the applicable statute of limitations or the duration of any sentence imposed1 including the period of post-conviction review4 7e7 ,additional requirements for approved vendors 7#a7 ,in general ,each approved vendor shall ensure that cloud-based storage and analytics of child pornography and child obscenity under this section remain in the ,united ,states4 7#b7 ,notification letter 7,a7 ,in general ,approved vendors shall file a notification letter with the ,department of ,justice not later than #cj days after entering into a contract described in subsection 7a77#a77;,b74 7,b7 ,contents ,the notification letter shall include the entity name and point of contact information of the approved vendor1 the name of the contracting agency1 the period of performance of the contract1 and an acknowledgment by the approved vendor that the approved vendor will notify the ,department of ,justice of any changes to the information in the letter4 7#c7 ,breach of contract 7,a7 ,in general ,if a law enforcement or prosecutorial agency fails to make required payment under a contract1 breaches any material term of such contract1 or otherwise terminates such contract without establishing lawful transfer of the evidence1 the approved vendor shall1 not later than #cj days after the failure1 breach1 or termination1 notify the ,department of ,justice1 or in the case of a ,state or local agency1 the appropriate ,state attorney general4 7,b7 ,maintenance of evidence ,upon making a notification under subparagraph 7,a71 the approved vendor shall continue to preserve and maintain the integrity of the evidence until a lawful transfer of custody occurs to the ,department of ,justice or another ,federal1 ,state1 or local law enforcement agency with jurisdiction4 4 7b7 ,clerical amendment ,section #a7;b7 of the ,,protect ,our ,children ,act of #bjjh 7,public ,law #aaj-dja2 #abb ,stat4 #dbbi7 is amended by inserting after the item relating to section #bja the following3 ,sec4 #bjb4 ,modernizing law enforcement's ability to store child pornography and child obscenity and limited liability for approved vendors4 4 #a4 ,short title ,this ,act may be cited as the ,safe ,cloud ,storage ,act4 #b4 ,storage of child pornography and child obscenity 7a7 ,in general ,title ,,ii of the ,,protect ,our ,children ,act of #bjjh 7#cd ,u4,s4,c4 #baaja et seq47 is amended by inserting after section #bja the following3 #bjb4 ,modernizing law enforcement's ability to store child pornography and child obscenity and limited liability for approved vendors 7a7 ,definitions ,in this section3 7#a7 ,approved vendor ,the term approved vendor means an organization1 corporation1 or entity that-- 7,a7 offers digital storage services1 including remote or cloud-based storage1 and analytical and forensic tool processing support2 and 7,b7 has been contractually retained by a covered agency to support the duties of such agency by-- 7i7 storing digital child pornography or child obscenity2 7ii7 making such child pornography or child obscenity available to the contracting agency1 or any law enforcement or prosecutorial agency designated by the contracting agency1 upon request2 and 7iii7 providing maintenance1 technical and analytical assistance1 and forensic tool processing support upon request by the contracting agency4 7#b7 ,child pornography ,the term child pornography has the meaning given that term in section #bbef7h7 of title #ah1 ,united ,states ,code4 7#c7 ,covered agency ,the term covered agency means a ,federal1 ,state1 or local law enforcement or prosecutorial agency4 7#d7 ,local ,the term local means any political subdivision of a ,state4 7#e7 ,state ,the term ,state means any of the #ej ,states of the ,united ,states1 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 the ,virgin ,islands of the ,united ,states1 ,guam1 ,american ,samoa1 or the ,commonwealth of the ,northern ,mariana ,islands4 7b7 ,limited liability for approved vendors 7#a7 ,limited liability for law enforcement approved vendors ,except as provided in paragraph 7#b71 a civil claim or criminal charge may not be brought in any ,federal or ,state court against an approved vendor relating to the approved vendor's performance of any contractual obligation or service described in subsection 7a77#a74 7#b7 ,intentional1 reckless1 or other misconduct ,a civil claim or criminal charge may be brought in any ,federal or ,state court against an approved vendor if the approved vendor-- 7,a7 engaged in-- 7i7 intentional misconduct2 or 7ii7 negligent conduct2 or 7,b7 acted1 or failed to act-- 7i7 with actual malice2 7ii7 with reckless disregard to a substantial risk of causing injury without legal justification2 or 7iii7 for a purpose unrelated to the performance of any responsibility or function described in subsection 7a77#a77;,b74 7c7 ,vendor cybersecurity requirements ,with respect to any child pornography or child obscenity stored1 maintained1 or processed by an approved vendor1 such approved vendor shall-- 7#a7 secure such child pornography or child obscenity in a manner that is consistent with the most recent version of the ,cybersecurity ,framework developed by the ,national ,institute of ,standards and ,technology1 or any successor thereto2 7#b7 only access the child pornography or child obscenity upon consent of the covered agency contracting the service and for the purpose of providing maintenance1 technical assistance1 and forensic tool processing support in the cloud2 7#c7 minimize the number of employees that may be able to obtain access to such child pornography or child obscenity and maintain a list of employees who have obtained such access2 7#d7 employ end-to-end encryption for data storage and transfer functions1 or an equivalent technological standard2 7#e7 undergo an independent annual cybersecurity audit to determine whether such child pornography or child obscenity is secured as required by paragraph 7#a71 including by assessing compliance with the ,national ,institute of ,standards and ,technology ,special ,publication #hjj-ec1 ,revision #e 7relating to security and privacy controls for information systems and organizations7 or any successor documents or revisions2 and 7#f7 promptly address all issues identified by an audit described in paragraph 7#e74 7d7 ,evidence storage ,any covered agency that stores child pornography and child obscenity pursuant to a contract with an approved vendor shall retain such evidence-- 7#a7 in compliance with the security policy of the ,criminal ,justice ,information ,services ,division of the ,federal ,bureau of ,investigation1 or any other similar and appropriate division within the ,federal ,bureau of ,investigation2 7#b7 for a period consistent with the evidence retention requirements applicable to the covered agency under the relevant ,federal1 ,state1 or local law1 rule of criminal procedure1 or prosecutorial policy2 or 7#c7 in the absence of such law1 rule1 or policy1 for a period not less than the applicable statute of limitations or the duration of any sentence imposed1 including the period of post-conviction review4 7e7 ,additional requirements for approved vendors 7#a7 ,location of data 7,a7 ,in general ,except as provided in subparagraph 7,b71 each approved vendor shall ensure that child pornography and child obscenity stored pursuant to this section remains in the ,united ,states4 7,b7 ,exception ,child pornography and child obscenity under this section may be transferred outside the ,united ,states only with the express consent of the contracting covered agency if such agency deems the transfer necessary for investigative purposes4 7#b7 ,notification letter 7,a7 ,in general ,approved vendors shall file a notification letter with the ,criminal ,division of the ,department of ,justice not later than #cj days after entering into a contract described in subsection 7a77#a77;,b74 7,b7 ,contents ,the notification letter described in subparagraph 7,a7 shall include the entity name and point of contact information of the approved vendor1 the name of the contracting covered agency1 the period of performance of the contract1 and an acknowledgment by the approved vendor that the approved vendor will notify the ,child ,exploitation and ,obscenity ,section of the ,criminal ,division of the ,department of ,justice of any changes to the information in the letter4 7#c7 ,breach of contract 7,a7 ,in general ,if a covered agency fails to make required payment under a contract1 breaches any material term of such contract1 or otherwise terminates such contract without establishing lawful transfer of the evidence1 the approved vendor shall1 not later than #cj days after the failure1 breach1 or termination1 notify the ,criminal ,division of the ,department of ,justice in the case of a breach by a ,federal agency1 or the appropriate ,state attorney general in the case of a breach by a ,state or local agency4 7,b7 ,maintenance of evidence ,upon making a notification under subparagraph 7,a71 the approved vendor shall continue to preserve and maintain the integrity of the evidence until a prompt and lawful transfer of custody occurs to the ,criminal ,division of the ,department of ,justice or another ,federal1 ,state1 or local law enforcement agency with jurisdiction4 7f7 ,rule of construction ,nothing in this section shall be construed to limit-- 7#a7 bona fide use by the contracting covered agency of child pornography or child obscenity being stored by the approved vendor1 which includes providing such child pornography or child obscenity to any other party as necessary for an investigation or prosecution2 or 7#b7 the obligation of the contracting covered agency to comply with a constitutional or statutory obligation1 court order1 or request from a victim made pursuant to section #ceji7m77#c7 of title #ah1 ,united ,states ,code4 4 7b7 ,clerical amendment ,section #a7;b7 of the ,,protect ,our ,children ,act of #bjjh 7,public ,law #aaj-dja2 #abb ,stat4 #dbbi7 is amended by inserting after the item relating to section #bja the following3 ,sec4 #bjb4 ,modernizing law enforcement's ability to store child pornography and child obscenity and limited liability for approved vendors4 4 ,february #bd1 #bjbf,reported with an amendment