S 3023: Safe Cloud Storage Act

S 3023 in plain English: This bill would extend legal liability protections to private technology vendors that contract with law enforcement agencies to store, maintain, and process child sexual abuse material (CSAM) during investigations of online child exploitation. Under current law, similar protections exist for vendors working directly with the National Center for Missing & Exploited Children, but not for those working with law enforcement. The bill adds cybersecurity and evidence-storage requirements for vendors handling this material.

Stated purpose

This bill aims to extend legal protections to cloud storage companies that contract with law enforcement agencies to store and handle child sexual abuse material (CSAM) during investigations, filling a gap in current law that only protects vendors working directly with the National Center for Missing & Exploited Children.

Key points

• Shields cloud storage vendors from civil and criminal liability when storing CSAM under law enforcement contracts
• Protections do not apply if a vendor engages in intentional misconduct, negligence, malice, or acts outside its contract
• Extends existing liability protections—currently limited to NCMEC contractors—to federal, state, and local law enforcement contractors
• Requires vendors to meet cybersecurity standards and evidence-retention rules for stored CSAM

Arguments supporters make

• Without liability protection, cloud vendors may refuse to work with law enforcement on CSAM cases, slowing or blocking investigations into child exploitation.
• The bill includes strong safeguards — mandatory encryption, annual audits, and strict access controls — that protect sensitive material from misuse or breach.
• Extending the same protections already given to NCMEC-contracted vendors to law enforcement-contracted vendors simply closes a legal gap and creates consistency.

Arguments opponents make

• Broad liability shields for private companies handling extremely sensitive material could reduce accountability if those companies mishandle or improperly access the content.
• The exceptions for misconduct require proving intent or negligence, which can be a high legal bar, potentially leaving victims of vendor errors without meaningful recourse.
• Delegating storage of the most sensitive possible material to private cloud vendors — even with cybersecurity rules — raises concerns about data security and the risk of breaches or leaks.

Tradeoffs

Making it easier for law enforcement to get cloud storage help for CSAM investigations may speed up child exploitation cases, but it does so by limiting the legal tools available to hold vendors accountable if something goes wrong with how that material is handled.

Current status in Congress: Passed Senate.

NewsClear — neutral news & congressional tracking · Bill of the Week