Safe Cloud Storage Act

New rules for storing child abuse evidence

If enacted, the bill would let federal, state, or local law enforcement or prosecutors hire private cloud or storage companies (called "approved vendors") to store and provide access to digital child pornography and child obscenity for investigations. Approved vendors would have to keep the data in the United States unless the hiring agency expressly consents to an overseas transfer. Vendors would be required to follow the most recent NIST Cybersecurity Framework, use end-to-end encryption or an equivalent standard, limit and record employee access, and undergo an independent annual cybersecurity audit that assesses compliance with NIST SP 800-53, Revision 5 (or a successor). Vendors would need to notify the Justice Department's Child Exploitation and Obscenity Section within 30 days of signing a contract and must notify DOJ CJIS (for federal breaches) or the appropriate state attorney general (for state/local breaches) within 30 days if a contracting agency fails to pay, materially breaches, or terminates a contract without lawful transfer; vendors must preserve evidence until it is lawfully transferred. The bill would generally shield approved vendors from civil or criminal claims for performing these contracted duties, but it would still allow claims for intentional misconduct, negligence, actual malice, reckless disregard of substantial risk, or acts outside the contracted responsibilities. The bill would also make clear it does not limit a contracting agency's bona fide use of evidence or its obligations under court orders or statutes, including 18 U.S.C. 3509(m)(3).