Safe Cloud Storage Act

Summary#

This bill adds a new section to the PROTECT Our Children Act. It defines an "approved vendor" as a company that stores digital child pornography or child obscenity for Federal, State, or local law enforcement and gives technical and forensic support. Approved vendors generally cannot be sued or charged for carrying out the duties in their contract. Exceptions allow civil or criminal claims if the vendor acted intentionally, negligently, with actual malice, with reckless disregard for serious risk, or for a purpose not related to the contract services.

The bill requires approved vendors to follow strong cybersecurity rules. Vendors must follow the NIST Cybersecurity Framework, use end-to-end encryption or an equivalent standard, limit employee access and keep an access list, and get an independent annual cybersecurity audit that looks at NIST SP 800-53 rev. 5 standards. Vendors must fix audit problems promptly.

The bill also sets rules for how long evidence must be kept. Evidence must meet FBI Criminal Justice Information Services security policies and follow the retention rules that apply to the contracting agency. If no rule applies, evidence must be kept at least as long as the statute of limitations or any sentence and post-conviction review.

Other rules require that stored material stay in the United States unless the contracting agency agrees it can be moved for investigative reasons. Approved vendors must notify the DOJ Criminal Division within 30 days after starting a contract and must report certain contract breaches or payment failures to the DOJ or state attorneys general and continue to preserve the evidence until custody is lawfully transferred. The bill also says it does not limit law enforcement from using the evidence for investigation or prosecution or an agency's legal obligations to comply with court orders or victim requests.

What it means for you#

• For cloud and storage companies: A new path to be an "approved vendor" for law enforcement. If you meet the contract, security, audit, and reporting rules, you get broad protection from civil lawsuits and criminal charges for actions tied to the contract. You must follow strict cybersecurity and notification requirements.
• For law enforcement and prosecutors: The bill clarifies that agencies may contract with private vendors to store and process child sexual abuse material. It sets rules for how evidence must be kept and transferred.
• For the public and victims: The bill does not change criminal definitions or prosecution rules in the text provided. It includes a rule saying agencies must still follow court orders and victim requests when appropriate.

Expenses#

No publicly available information on costs, funding, or estimated budgetary effects is included in the bill text or the provided metadata.

Proponents' View#

The bill's stated purpose in its title and text is to modernize law enforcement's ability to store child pornography and child obscenity and to limit liability for private vendors that store and process that material for covered agencies, while requiring security and oversight measures.

Opponents' View#

No publicly available information on opponents' views or stated objections is included in the bill text or the provided metadata.