Safe Cloud Storage Act

The Safe Cloud Storage Act amends the PROTECT Our Children Act of 2008 to establish a framework for federal, state, and local law enforcement agencies to securely store digital child pornography and child obscenity (CSAM) with third-party vendors. It introduces the concept of an "approved vendor" , defined as an organization providing digital storage, analytical, and forensic support under contract to a law enforcement or prosecutorial agency. A core provision of the bill grants limited civil and criminal liability to these approved vendors for actions taken in performance of their contractual duties. However, this protection does not extend to cases involving intentional misconduct, negligent conduct, actual malice, reckless disregard, or actions unrelated to their contracted responsibilities. To ensure the integrity and security of the sensitive material, the bill mandates stringent cybersecurity requirements for approved vendors. These include adherence to the NIST Cybersecurity Framework, employing end-to-end encryption, minimizing employee access, and undergoing annual independent cybersecurity audits. Furthermore, the legislation outlines specific requirements for the handling of this evidence, such as ensuring data remains within the United States unless an investigative necessity dictates otherwise. Approved vendors must also notify the Department of Justice upon entering contracts and, in cases of agency contract breach, must inform the appropriate authorities while continuing to preserve the evidence until lawful transfer.