Bill > S3023

This bill, titled the "Safe Cloud Storage Act," aims to protect certain entities, referred to as "approved vendors," from civil claims or criminal charges when they store child pornography, child obscenity, or intimate visual depictions of minors for law enforcement agencies. An "approved vendor" is defined as a cloud service provider that meets specific security requirements and is contractually hired by a "covered agency" (federal, state, or local law enforcement or prosecutorial agency) to store and provide access to this material for investigative purposes. The bill outlines strict cybersecurity requirements for these vendors, including using the National Institute of Standards and Technology (NIST) Cybersecurity Framework, employing end-to-end encryption, minimizing employee access, and undergoing annual audits. Liability is limited unless the approved vendor engages in intentional misconduct, negligence, or acts with actual malice or reckless disregard. The bill also details requirements for evidence storage by covered agencies and additional obligations for approved vendors, such as keeping data within the United States unless otherwise agreed, notifying the Department of Justice about contracts, and continuing to maintain evidence if a contract is breached. This legislation seeks to modernize law enforcement's ability to handle sensitive digital evidence while providing a legal shield for approved vendors who comply with stringent security and operational protocols.