Online drug crime reporting

Summary#

This bill would add a new rule to the federal Controlled Substances Act that requires many online service providers to report suspected crimes involving certain drugs (fentanyl, methamphetamine), counterfeit drugs, and illegal sales of prescription medications to the Attorney General. Providers must file a report within 60 days after they learn of relevant facts, and the Attorney General must review reports, preserve data for investigations, and publish an annual summary. The bill aims to reduce illegal drug sales and manufacturing that occur using Internet services.

Important changes:

• Who must report: “Providers” (electronic communication service providers and remote computing services) must report when they obtain actual knowledge, or may report on a reasonable belief, that covered drug crimes are occurring on their services.
• What to report: Provider contact info, account identifiers (names, email, IP, URLs, screen names), and optionally content or other data such as photos, messages, timestamps, and location info.
• Timing and preservation: Reports must be made as soon as reasonably possible and no later than 60 days; a report counts as a request to preserve the reported contents and related data for 90 days.
• Penalties: Knowing failure to report is a criminal offense with fines (up to $190,000 for first offense, $380,000 for later offenses). False or knowingly incomplete reports can bring civil penalties ($50,000–$100,000).
• Protections and limits: Providers are not required to monitor users, scan all content, or break end-to-end encryption. Broadband Internet access and text messaging providers are exempt when acting only as such.

What it means for you#

• Online service providers (social platforms, email hosts, cloud services, web hosts):

  • Must set up a process to detect (or accept reports of) and send reports to the Attorney General when they have actual knowledge of the covered drug crimes.
  • May choose to include full message contents or other files in the report, but are not forced to do so.
  • Must preserve reported items and related context for 90 days and may delay user notice about preservation under rules in the bill.
  • Face substantial fines for knowingly failing to report or for knowingly false/omitted information.

• Users of online services:

  • If a user’s account is the subject of a report, the provider may preserve account data for at least 90 days and may delay telling the user about that preservation for a statutory period.
  • The bill allows providers to use end-to-end encryption and does not require decryption.

• Law enforcement and the Justice Department:

  • The Attorney General will review reports and may forward them to federal, state, or local agencies for further investigation.
  • The Justice Department must publish an annual report with counts and breakdowns of reports, outcomes, and whether content was found by humans or by automated means.

• Broadband and text messaging companies:

  • The bill exempts providers of broadband Internet access service and text messaging service from the reporting and related provisions when they are acting only as those services.

Expenses#

No publicly available information.

Possible costs implied by the bill:

• Providers likely will face compliance costs for building reporting systems, legal review, staff time for reviewing and preserving data, and secure storage for preserved materials.
• The Department of Justice may need staffing, systems, and storage to process, review, investigate, and publish annual report data.
• There may be legal and operational costs tied to preservation requests, delayed user notifications, and responding to subpoenas or court orders.

Proponents' View#

• The bill appears intended to reduce the online sale and distribution of dangerous drugs, especially fentanyl and methamphetamine.
• Supporters may argue that centralized reporting to the Attorney General will help federal investigators discover and stop criminal networks using internet services.
• Requiring a preservation period (90 days) could make it easier for investigators to get evidence before it is deleted.
• The annual public report could provide data to measure how many reports lead to investigations and convictions.
• The bill allows providers to keep encryption and does not force routine monitoring, which supporters could point to as balancing privacy and enforcement.

Opponents' View#

• One concern is that the bill’s terms like “actual knowledge” and “reasonable belief” are not precisely defined, which could push providers to over-report to avoid heavy penalties.
• The need to preserve data and the option to include full communications may raise privacy concerns and could lead to broader retention of user data by providers.
• Providers may face substantial compliance costs, especially smaller or non-U.S. providers that must build new systems and processes.
• The statute allows delayed notice to users about preservation, which may limit users’ ability to challenge preservation or take remedial steps promptly.
• It is unclear how the Attorney General will manage large volumes of reports or whether the annual reporting requirements will be sufficient to show effectiveness.