Safe Cloud Storage Act
Sponsored By: Representative Lee, Laurel M. [R-FL-15]
Passed House
Summary
Secure cloud storage for child sexual exploitation evidence. This bill would create rules allowing federal, state, tribal, and local law enforcement to hire certified cloud vendors to store, provide access to, and perform forensic processing on child pornography, child obscenity, and intimate visual depictions of minors while imposing strict security and access limits.
Show full summary
- Law enforcement and prosecutors would be able to contract approved cloud service providers to hold and analyze sensitive evidence, with default U.S. storage and agency-controlled access.
- Cloud service providers could qualify as "approved vendors" if they meet cybersecurity, contractual, and audit requirements and would receive limited civil and criminal liability for carrying out their contracted duties, except for intentional misconduct, negligent acts showing actual malice, reckless disregard, or unrelated conduct.
- The bill requires strong technical and record rules for approved vendors: end-to-end encryption or equivalent, access minimization and lists, annual independent cybersecurity audits measured against NIST standards, retention under FBI Criminal Justice Information Services policies or for at least the statute of limitations or sentence duration, a 30-day DOJ notification for covered contracts, and preservation obligations if an agency breaches or terminates a contract until lawful transfer of evidence occurs.
Personalized for You
How does this bill affect your finances?
Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
2 provisions identified: 1 benefits, 0 costs, 1 mixed.
Rules for evidence storage and agency use
If enacted, agencies that store this material with an approved vendor would have to keep it under one of three rules. They would either follow FBI CJIS security policy, follow existing federal, state, or local retention rules, or, if none exist, keep it at least through the statute of limitations or the full sentence, including post‑conviction review. The bill would also state that nothing limits an agency’s good‑faith use or sharing of the material for investigations or prosecutions. Agencies would still have to follow the Constitution, statutes, court orders, and victim requests under 18 U.S.C. 3509(m)(3), and no audits of government systems would be required by this section.
New rules and shield for cloud providers
If enacted, the bill would define which cloud providers count as approved vendors for law enforcement evidence. Approved vendors would need to store this material in the U.S. unless the agency allows a foreign transfer for an investigation. They would limit and log staff access, use end‑to‑end encryption, follow the latest NIST cybersecurity framework, and complete an independent annual audit against NIST SP 800-53. Vendors would have to notify DOJ within 30 days of signing a qualifying contract, and within 30 days if an agency fails to pay, breaches, or ends a contract without a lawful transfer, while preserving the evidence until transfer. The bill would also give vendors a legal shield for work done under the contract, but not for intentional wrongdoing, negligence, actual malice, reckless disregard without legal justification, or acts unrelated to the contract.
Sponsors & CoSponsors
Sponsor
Lee, Laurel M. [R-FL-15]
FL • R
Cosponsors
Rep. Dean, Madeleine [D-PA-4]
PA • D
Sponsored 3/5/2026
Rep. Cohen, Steve [D-TN-9]
TN • D
Sponsored 3/5/2026
Rep. Knott, Brad [R-NC-13]
NC • R
Sponsored 3/5/2026
Rep. McGuire, John J. [R-VA-5]
VA • R
Sponsored 6/9/2026
Rep. Hageman, Harriet M. [R-WY-At Large]
WY • R
Sponsored 8/27/2026
Roll Call Votes
No roll call votes available for this bill.
View on Congress.gov