[Congressional Record Volume 169, Number 206 (Thursday, December 14, 2023)]
[Senate]
[Pages S6006-S6008]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
REVISING EXISTING PROCEDURES ON REPORTING VIA TECHNOLOGY ACT
Mr. SCHUMER. Mr. President, I ask unanimous consent that the Senate
proceed to the immediate consideration of Calendar No. 85, S. 474.
The PRESIDING OFFICER. The clerk will report the bill by title.
The legislative clerk read as follows:
A bill (S. 474) to amend title 18, United States Code, to
strengthen reporting to the CyberTipline related to online
sexual exploitation of children, to modernize liabilities for
such reports, to preserve the contents of such reports for 1
year, and for other purposes.
There being no objection, the Senate proceeded to consider the bill,
which had been reported from the Committee on the Judiciary with an
amendment to strike all after the enacting clause and insert in lieu
thereof the following:
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Revising Existing Procedures
On Reporting via Technology Act'' or the ``REPORT Act''.
SEC. 2. LIMITED LIABILITY MODERNIZATION.
(a) Amendments.--Section 2258B of title 18, United States
Code, is amended--
(1) in the section heading, by striking ``providers or
domain name registrars'' and inserting ``the reporting,
storage, and handling of certain visual depictions of
apparent child pornography to the National Center for Missing
& Exploited Children'';
(2) in subsection (b)--
(A) in the matter preceding paragraph (1), by inserting
``or charge'' after ``a claim''; and
(B) in paragraph (2)(C), by striking ``this section,''; and
(3) by adding at the end the following:
``(d) Limited Liability for NCMEC-Contracted Vendors.--
``(1) In general.--Except as provided in paragraph (2), a
civil claim or criminal charge may not be brought in any
Federal or State court against a vendor contractually
retained and designated by NCMEC to support the duties of
NCMEC under section 404(b)(1)(K) of the Juvenile Justice and
Delinquency Prevention Act of 1974 (34 U.S.C.
11293(b)(1)(K)).
``(2) Intentional, reckless, or other misconduct.--
Paragraph (1) shall not apply to a claim or charge if the
vendor--
``(A) engaged in--
``(i) intentional misconduct; or
``(ii) negligent conduct; or
[[Page S6007]]
``(B) acted, or failed to act--
``(i) with actual malice;
``(ii) with reckless disregard to a substantial risk of
causing injury without legal justification; or
``(iii) for a purpose unrelated to the performance of any
responsibility or function--
``(I) set forth in paragraph (1); or
``(II) pursuant to sections 2258A, 2258C, 2702, or 2703.
``(3) Minimizing access by vendor.--With respect to any
visual depiction provided pursuant to the duties of NCMEC
under section 404(b)(1)(K) of the Juvenile Justice and
Delinquency Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K))
that is stored or transferred by a vendor contractually
retained and designated by NCMEC to support such duties of
NCMEC, a vendor shall--
``(A) minimize the number of employees that may be able to
obtain access to such visual depiction; and
``(B) employ end-to-end encryption for data storage and
transfer functions, or an equivalent technological standard.
``(e) Limited Liability for Reporting Apparent Child
Pornography by an Individual Depicted in the Child
Pornography as a Minor, or a Representative of Such
Individual.--
``(1) In general.--Except as provided in paragraph (2), a
civil claim or criminal charge may not be brought in any
Federal or State court against an individual depicted in
child pornography as a minor, or a representative of such
individual, arising from a report to the NCMEC CyberTipline
by the individual, or the representative of such individual,
of information that relates to the child pornography in which
the individual is depicted as a minor, including a copy of
the child pornography.
``(2) Intentional, reckless, or other misconduct.--
Paragraph (1) shall not apply to a claim or charge if the
individual, or the representative of such individual--
``(A) engaged in--
``(i) intentional misconduct;
``(ii) negligent conduct; or
``(iii) any activity which constitutes a violation of
section 2251; or
``(B) acted, or failed to act--
``(i) with actual malice; or
``(ii) with reckless disregard to a substantial risk of
causing injury without legal justification.
``(3) Minimizing access.--With respect to any child
pornography reported to the NCMEC CyberTipline by an
individual depicted in the child pornography as a minor, or a
representative of such individual, NCMEC shall minimize
access to the child pornography and ensure the appropriate
deletion of the child pornography, as set forth in section
2258D.
``(4) Definition.--For purposes of this subsection, the
term `representative', with respect to an individual depicted
in child pornography--
``(A) means--
``(i) the parent or legal guardian of the individual, if
the individual is under 18 years of age;
``(ii) the legal guardian or other person appointed by a
court to represent the individual;
``(iii) a legal representative retained by the individual;
``(iv) a representative of the estate of the individual; or
``(v) a person who is a mandated reporter under section
226(a)(1) of the Victims of Child Abuse Act of 1990 (34
U.S.C. 20341(a)(1)); and
``(B) does not include a person who engaged in any activity
which constitutes a violation of section 2251.''.
(b) Applicability.--The amendments made by subsection (a)
shall apply with respect to a civil claim or criminal charge
that is filed on or after the date of enactment of this Act.
(c) Table of Sections Amendment.--The table of sections for
chapter 110 of title 18, United States Code, is amended by
striking the item relating to section 2258B and inserting the
following:
``2258B. Limited liability for the reporting, storage, and handling of
certain visual depictions of apparent child pornography
to the National Center for Missing & Exploited
Children.''.
SEC. 3. PRESERVATION OF REPORTS TO CYBERTIPLINE RELATED TO
ONLINE SEXUAL EXPLOITATION OF CHILDREN.
Section 2258A(h) of title 18, United States Code, is
amended--
(1) in paragraph (1), by striking ``90 days'' and inserting
``1 year''; and
(2) by adding at the end the following:
``(5) Extension of preservation.--A provider of a report to
the CyberTipline under subsection (a)(1) may voluntarily
preserve the contents provided in the report (including any
comingled content described in paragraph (2)) for longer than
1 year after the submission to the CyberTipline for the
purpose of reducing the proliferation of online child sexual
exploitation or preventing the online sexual exploitation of
children.
``(6) Method of preservation.--Not later than 1 year after
the date of enactment of this paragraph, a provider of a
report to the CyberTipline under subsection (a)(1) shall
preserve materials under this subsection in a manner that is
consistent with the most recent version of the Cybersecurity
Framework developed by the National Institute of Standards
and Technology, or any successor thereto.''.
SEC. 4. STRENGTHENING OF DUTY TO REPORT APPARENT VIOLATIONS
TO CYBERTIPLINE RELATED TO ONLINE EXPLOITATION
OF CHILDREN.
(a) Amendments.--Section 2258A of title 18, United States
Code, is amended--
(1) in subsection (a)(2)(A), by inserting ``, of section
1591 (if the violation involves a minor), or of 2422(b)''
after ``child pornography''; and
(2) in subsection (e)--
(A) in paragraph (1), by striking ``$150,000'' and
inserting ``$850,000 in the case of a provider with not less
than 100,000,000 monthly active users or $600,000 in the case
of a provider with less than 100,000,000 monthly active
users''; and
(B) in paragraph (2), by striking ``$300,000'' and
inserting ``$1,000,000 in the case of a provider with not
less than 100,000,000 monthly active users or $850,000 in the
case of a provider with less than 100,000,000 monthly active
users''.
(b) Guidelines.--Not later than 180 days after the date of
enactment of this Act, the National Center for Missing &
Exploited Children may issue guidelines, as appropriate, to
providers required or permitted to take actions described in
section 2258A(a)(1)(B) of title 18, United States Code, on
the relevant identifiers for content that may indicate sex
trafficking of children, as described in section 1591 of that
title, or enticement, as described in section 2422(b) of that
title.
Mr. WYDEN. Mr. President, I expect that the Senate will soon pass by
unanimous consent the Blackburn-Ossoff REPORT Act. This bill will
strengthen the Nation's centralized reporting system for the online
exploitation of children, operated by the National Center for Missing
and Exploited Children, to better protect children from online sexual
abuse and exploitation. Senators Blackburn and Ossoff worked closely
with me to make important changes to this bill to require that the
upgraded CyberTipline be secured consistent with Federal cybersecurity
best practices, so that hackers are not able to steal and then
distribute the extremely sensitive images and videos documenting abuse
that are stored in this system. I sincerely appreciate their
partnership on this important issue.
Mr. SCHUMER. I ask unanimous consent that the committee-reported
amendment be withdrawn; that the Blackburn substitute amendment at the
desk be considered and agreed to; that the bill, as amended, be
considered read a third time and passed; and that the motion to
reconsider be considered made and laid upon the table.
The PRESIDING OFFICER. Without objection, it is so ordered.
The committee-reported amendment in the nature of a substitute was
withdrawn.
The amendment (No. 1377) in the nature of a substitute was agreed to,
as follows:
(Purpose: In the nature of a substitute)
Strike all after the enacting clause and insert the
following:
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Revising Existing Procedures
On Reporting via Technology Act'' or the ``REPORT Act''.
SEC. 2. LIMITED LIABILITY MODERNIZATION.
(a) Amendments.--Section 2258B of title 18, United States
Code, is amended--
(1) in the section heading, by striking ``providers or
domain name registrars'' and inserting ``the reporting,
storage, and handling of certain visual depictions of
apparent child pornography to the National Center for Missing
& Exploited Children'';
(2) in subsection (b)--
(A) in the matter preceding paragraph (1), by inserting
``or charge'' after ``a claim''; and
(B) in paragraph (2)(C), by striking ``this section,''; and
(3) by adding at the end the following:
``(d) Limited Liability for NCMEC-Contracted Vendors.--
``(1) In general.--Except as provided in paragraph (2), a
civil claim or criminal charge may not be brought in any
Federal or State court against a vendor contractually
retained and designated by NCMEC to support the duties of
NCMEC under section 404(b)(1)(K) of the Juvenile Justice and
Delinquency Prevention Act of 1974 (34 U.S.C.
11293(b)(1)(K)).
``(2) Intentional, reckless, or other misconduct.--
Paragraph (1) shall not apply to a claim or charge if the
vendor--
``(A) engaged in--
``(i) intentional misconduct; or
``(ii) negligent conduct; or
``(B) acted, or failed to act--
``(i) with actual malice;
``(ii) with reckless disregard to a substantial risk of
causing injury without legal justification; or
``(iii) for a purpose unrelated to the performance of any
responsibility or function--
``(I) set forth in paragraph (1); or
``(II) pursuant to sections 2258A, 2258C, 2702, or 2703.
``(3) Vendor cybersecurity requirements.--With respect to
any visual depiction provided pursuant to the duties of NCMEC
under section 404(b)(1)(K) of the Juvenile Justice and
Delinquency Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K))
that is stored or transferred by a vendor contractually
retained and designated by NCMEC to support such duties of
NCMEC, a vendor shall--
``(A) secure such visual depiction in a manner that is
consistent with the most recent
[[Page S6008]]
version of the Cybersecurity Framework developed by the
National Institute of Standards and Technology, or any
successor thereto;
``(B) minimize the number of employees that may be able to
obtain access to such visual depiction;
``(C) employ end-to-end encryption for data storage and
transfer functions, or an equivalent technological standard;
``(D) undergo an independent annual cybersecurity audit to
determine whether such visual depiction is secured as
required under subparagraph (A); and
``(E) promptly address all issues identified by an audit
described in subparagraph (D).
``(e) Limited Liability for Reporting Apparent Child
Pornography by an Individual Depicted in the Child
Pornography as a Minor, or a Representative of Such
Individual.--
``(1) In general.--Except as provided in paragraph (2), a
civil claim or criminal charge may not be brought in any
Federal or State court against an individual depicted in
child pornography as a minor, or a representative of such
individual, arising from a report to the NCMEC CyberTipline
by the individual, or the representative of such individual,
of information that relates to the child pornography in which
the individual is depicted as a minor, including a copy of
the child pornography.
``(2) Intentional, reckless, or other misconduct.--
Paragraph (1) shall not apply to a claim or charge if the
individual, or the representative of such individual--
``(A) engaged in--
``(i) intentional misconduct;
``(ii) negligent conduct; or
``(iii) any activity which constitutes a violation of
section 2251; or
``(B) acted, or failed to act--
``(i) with actual malice; or
``(ii) with reckless disregard to a substantial risk of
causing injury without legal justification.
``(3) Minimizing access.--With respect to any child
pornography reported to the NCMEC CyberTipline by an
individual depicted in the child pornography as a minor, or a
representative of such individual, NCMEC shall minimize
access to the child pornography and ensure the appropriate
deletion of the child pornography, as set forth in section
2258D.
``(4) Definition.--For purposes of this subsection, the
term `representative', with respect to an individual depicted
in child pornography--
``(A) means--
``(i) the parent or legal guardian of the individual, if
the individual is under 18 years of age;
``(ii) the legal guardian or other person appointed by a
court to represent the individual;
``(iii) a legal representative retained by the individual;
``(iv) a representative of the estate of the individual; or
``(v) a person who is a mandated reporter under section
226(a)(1) of the Victims of Child Abuse Act of 1990 (34
U.S.C. 20341(a)(1)); and
``(B) does not include a person who engaged in any activity
which constitutes a violation of section 2251.''.
(b) Applicability.--The amendments made by subsection (a)
shall apply with respect to a civil claim or criminal charge
that is filed on or after the date of enactment of this Act.
(c) Table of Sections Amendment.--The table of sections for
chapter 110 of title 18, United States Code, is amended by
striking the item relating to section 2258B and inserting the
following:
``2258B. Limited liability for the reporting, storage, and handling of
certain visual depictions of apparent child pornography
to the National Center for Missing & Exploited
Children.''.
SEC. 3. PRESERVATION OF REPORTS TO CYBERTIPLINE RELATED TO
ONLINE SEXUAL EXPLOITATION OF CHILDREN.
Section 2258A(h) of title 18, United States Code, is
amended--
(1) in paragraph (1), by striking ``90 days'' and inserting
``1 year''; and
(2) by adding at the end the following:
``(5) Extension of preservation.--A provider of a report to
the CyberTipline under subsection (a)(1) may voluntarily
preserve the contents provided in the report (including any
comingled content described in paragraph (2)) for longer than
1 year after the submission to the CyberTipline for the
purpose of reducing the proliferation of online child sexual
exploitation or preventing the online sexual exploitation of
children.
``(6) Method of preservation.--Not later than 1 year after
the date of enactment of this paragraph, a provider of a
report to the CyberTipline under subsection (a)(1) shall
preserve materials under this subsection in a manner that is
consistent with the most recent version of the Cybersecurity
Framework developed by the National Institute of Standards
and Technology, or any successor thereto.''.
SEC. 4. STRENGTHENING OF DUTY TO REPORT APPARENT VIOLATIONS
TO CYBERTIPLINE RELATED TO ONLINE EXPLOITATION
OF CHILDREN.
(a) Amendments.--Section 2258A of title 18, United States
Code, is amended--
(1) in subsection (a)(2)(A), by inserting ``, of section
1591 (if the violation involves a minor), or of 2422(b)''
after ``child pornography''; and
(2) in subsection (e)--
(A) in paragraph (1), by striking ``$150,000'' and
inserting ``$850,000 in the case of a provider with not less
than 100,000,000 monthly active users or $600,000 in the case
of a provider with less than 100,000,000 monthly active
users''; and
(B) in paragraph (2), by striking ``$300,000'' and
inserting ``$1,000,000 in the case of a provider with not
less than 100,000,000 monthly active users or $850,000 in the
case of a provider with less than 100,000,000 monthly active
users''.
(b) Guidelines.--Not later than 180 days after the date of
enactment of this Act, the National Center for Missing &
Exploited Children may issue guidelines, as appropriate, to
providers required or permitted to take actions described in
section 2258A(a)(1)(B) of title 18, United States Code, on
the relevant identifiers for content that may indicate sex
trafficking of children, as described in section 1591 of that
title, or enticement, as described in section 2422(b) of that
title.
The bill (S. 474), as amended, was ordered to be engrossed for a
third reading, was read the third time, and passed.
____________________