Safe Cloud Storage Act

This bill, known as the "Safe Cloud Storage Act," aims to modernize law enforcement's ability to store and analyze child sexual abuse material (CSAM) by providing limited liability protection to approved third-party vendors. It defines an approved vendor as an entity offering digital storage, analytical, and forensic support, contractually retained by law enforcement to manage CSAM evidence. This protection is intended to encourage more entities to offer these specialized services, which are crucial for investigations. The legislation grants these approved vendors immunity from civil claims or criminal charges related to their contractual obligations, with specific exceptions for intentional misconduct , negligent conduct, actual malice, or reckless disregard. To ensure the secure handling of sensitive data, approved vendors must adhere to stringent cybersecurity requirements. These include securing visual depictions consistent with the NIST Cybersecurity Framework , employing end-to-end encryption, minimizing employee access, and undergoing independent annual cybersecurity audits. Furthermore, the bill mandates that all cloud-based storage and analytics of CSAM must remain within the United States . Approved vendors are required to file a notification letter with the Department of Justice upon entering a contract and must notify the DOJ if a contracting agency breaches its agreement, ensuring continued preservation of evidence. Law enforcement agencies themselves must also retain evidence in compliance with FBI CJIS security policies and applicable retention laws.