Safe Cloud Storage Act
Sponsored By: Representative Lee (FL)
Introduced
Summary
This bill would create a statutory framework letting contracted cloud storage providers hold child pornography and child obscenity for law enforcement while providing limited liability for approved vendors. It would also impose strict cybersecurity, U.S. data localization, evidence retention, and notification requirements.
Show full summary
- Approved vendors would get broad civil and criminal immunity for performing contracted duties, with narrow exceptions for intentional misconduct, negligence, actual malice, or reckless, unjustified acts.
- Vendors would be required to follow the latest NIST Cybersecurity Framework, use end-to-end encryption, limit and document personnel access, and undergo an independent annual audit against NIST SP 800-53 Rev. 5 or successors with prompt remediation.
- Data handling rules would require U.S. localization except for limited investigative transfers, retention aligned with FBI Criminal Justice Information Services policy or applicable law, or at least the statute of limitations, and preservation of evidence integrity until lawful transfer.
- Vendors must notify the Department of Justice Criminal Division within 30 days after entering a covered contract and report breaches to DOJ or a State attorney general. The bill also preserves agencies' ability to use stored material for investigations, prosecutions, and victim requests.
Your PRIA Score
Personalized for You
How does this bill affect your finances?
Sign up for a PRIA Policy Scan to see your personalized alignment score for this bill and every other piece of legislation we track. We analyze your financial profile against policy provisions to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
3 provisions identified: 2 benefits, 1 costs, 0 mixed.
Protections and definition for cloud vendors
If enacted, the bill would create a legal category called an "approved vendor." An approved vendor would be a company under contract to store or process child pornography or child obscenity for a federal, state, or local law enforcement or prosecuting agency and to provide maintenance and forensic support. The bill would generally bar civil or criminal suits against approved vendors for performing those contractual duties. Vendors would still face liability for intentional misconduct, negligence, actual malice, reckless disregard of a substantial risk of injury, or acts unrelated to the contract.
Evidence retention rules for law enforcement
If enacted, the bill would require agencies that use approved vendors to follow FBI CJIS security policy or similar FBI standards for stored evidence. Agencies would have to keep evidence according to applicable Federal, State, or local law, rules of criminal procedure, or prosecutorial policy. If no such rule exists, agencies would have to retain evidence at least as long as the applicable statute of limitations or any sentence imposed, including post-conviction review. The bill would not limit bona fide agency use of the evidence and would preserve obligations to follow court orders and victim requests.
Vendor cybersecurity and U.S. storage rules
If enacted, approved vendors would generally have to keep stored child pornography and child obscenity inside the United States. Transfers abroad would be allowed only with the contracting agency’s express consent when needed for an investigation. Vendors would have to follow the latest NIST cybersecurity framework, use end-to-end encryption (or equivalent), limit and record which employees can access the material, and access files only with agency consent for maintenance or forensic work. Vendors would need an independent annual cybersecurity audit against NIST SP 800-53 Revision 5 (or successor) and to fix problems promptly. Vendors must also notify the Justice Department’s Criminal Division within 30 days after signing a covered contract and report certain agency breaches, and they must preserve evidence until lawful transfer.
Sponsors & CoSponsors
Sponsor
Lee (FL)
FL • R
Cosponsors
Rep. Dean, Madeleine [D-PA-4]
PA • D
Sponsored 3/5/2026
Cohen
TN • D
Sponsored 3/5/2026
Knott
NC • R
Sponsored 3/5/2026
Roll Call Votes
No roll call votes available for this bill.
View on Congress.gov