[Congressional Record Volume 169, Number 206 (Thursday, December 14, 2023)]
[Senate]
[Pages S6006-S6008]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]




      REVISING EXISTING PROCEDURES ON REPORTING VIA TECHNOLOGY ACT

  Mr. SCHUMER. Mr. President, I ask unanimous consent that the Senate 
proceed to the immediate consideration of Calendar No. 85, S. 474.
  The PRESIDING OFFICER. The clerk will report the bill by title.
  The legislative clerk read as follows:

       A bill (S. 474) to amend title 18, United States Code, to 
     strengthen reporting to the CyberTipline related to online 
     sexual exploitation of children, to modernize liabilities for 
     such reports, to preserve the contents of such reports for 1 
     year, and for other purposes.

  There being no objection, the Senate proceeded to consider the bill, 
which had been reported from the Committee on the Judiciary with an 
amendment to strike all after the enacting clause and insert in lieu 
thereof the following:

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``Revising Existing Procedures 
     On Reporting via Technology Act'' or the ``REPORT Act''.

     SEC. 2. LIMITED LIABILITY MODERNIZATION.

       (a) Amendments.--Section 2258B of title 18, United States 
     Code, is amended--
       (1) in the section heading, by striking ``providers or 
     domain name registrars'' and inserting ``the reporting, 
     storage, and handling of certain visual depictions of 
     apparent child pornography to the National Center for Missing 
     & Exploited Children'';
       (2) in subsection (b)--
       (A) in the matter preceding paragraph (1), by inserting 
     ``or charge'' after ``a claim''; and
       (B) in paragraph (2)(C), by striking ``this section,''; and
       (3) by adding at the end the following:
       ``(d) Limited Liability for NCMEC-Contracted Vendors.--
       ``(1) In general.--Except as provided in paragraph (2), a 
     civil claim or criminal charge may not be brought in any 
     Federal or State court against a vendor contractually 
     retained and designated by NCMEC to support the duties of 
     NCMEC under section 404(b)(1)(K) of the Juvenile Justice and 
     Delinquency Prevention Act of 1974 (34 U.S.C. 
     11293(b)(1)(K)).
       ``(2) Intentional, reckless, or other misconduct.--
     Paragraph (1) shall not apply to a claim or charge if the 
     vendor--
       ``(A) engaged in--
       ``(i) intentional misconduct; or
       ``(ii) negligent conduct; or

[[Page S6007]]

       ``(B) acted, or failed to act--
       ``(i) with actual malice;
       ``(ii) with reckless disregard to a substantial risk of 
     causing injury without legal justification; or
       ``(iii) for a purpose unrelated to the performance of any 
     responsibility or function--

       ``(I) set forth in paragraph (1); or
       ``(II) pursuant to sections 2258A, 2258C, 2702, or 2703.

       ``(3) Minimizing access by vendor.--With respect to any 
     visual depiction provided pursuant to the duties of NCMEC 
     under section 404(b)(1)(K) of the Juvenile Justice and 
     Delinquency Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K)) 
     that is stored or transferred by a vendor contractually 
     retained and designated by NCMEC to support such duties of 
     NCMEC, a vendor shall--
       ``(A) minimize the number of employees that may be able to 
     obtain access to such visual depiction; and
       ``(B) employ end-to-end encryption for data storage and 
     transfer functions, or an equivalent technological standard.
       ``(e) Limited Liability for Reporting Apparent Child 
     Pornography by an Individual Depicted in the Child 
     Pornography as a Minor, or a Representative of Such 
     Individual.--
       ``(1) In general.--Except as provided in paragraph (2), a 
     civil claim or criminal charge may not be brought in any 
     Federal or State court against an individual depicted in 
     child pornography as a minor, or a representative of such 
     individual, arising from a report to the NCMEC CyberTipline 
     by the individual, or the representative of such individual, 
     of information that relates to the child pornography in which 
     the individual is depicted as a minor, including a copy of 
     the child pornography.
       ``(2) Intentional, reckless, or other misconduct.--
     Paragraph (1) shall not apply to a claim or charge if the 
     individual, or the representative of such individual--
       ``(A) engaged in--
       ``(i) intentional misconduct;
       ``(ii) negligent conduct; or
       ``(iii) any activity which constitutes a violation of 
     section 2251; or
       ``(B) acted, or failed to act--
       ``(i) with actual malice; or
       ``(ii) with reckless disregard to a substantial risk of 
     causing injury without legal justification.
       ``(3) Minimizing access.--With respect to any child 
     pornography reported to the NCMEC CyberTipline by an 
     individual depicted in the child pornography as a minor, or a 
     representative of such individual, NCMEC shall minimize 
     access to the child pornography and ensure the appropriate 
     deletion of the child pornography, as set forth in section 
     2258D.
       ``(4) Definition.--For purposes of this subsection, the 
     term `representative', with respect to an individual depicted 
     in child pornography--
       ``(A) means--
       ``(i) the parent or legal guardian of the individual, if 
     the individual is under 18 years of age;
       ``(ii) the legal guardian or other person appointed by a 
     court to represent the individual;
       ``(iii) a legal representative retained by the individual;
       ``(iv) a representative of the estate of the individual; or
       ``(v) a person who is a mandated reporter under section 
     226(a)(1) of the Victims of Child Abuse Act of 1990 (34 
     U.S.C. 20341(a)(1)); and
       ``(B) does not include a person who engaged in any activity 
     which constitutes a violation of section 2251.''.
       (b) Applicability.--The amendments made by subsection (a) 
     shall apply with respect to a civil claim or criminal charge 
     that is filed on or after the date of enactment of this Act.
       (c) Table of Sections Amendment.--The table of sections for 
     chapter 110 of title 18, United States Code, is amended by 
     striking the item relating to section 2258B and inserting the 
     following:

``2258B. Limited liability for the reporting, storage, and handling of 
              certain visual depictions of apparent child pornography 
              to the National Center for Missing & Exploited 
              Children.''.

     SEC. 3. PRESERVATION OF REPORTS TO CYBERTIPLINE RELATED TO 
                   ONLINE SEXUAL EXPLOITATION OF CHILDREN.

       Section 2258A(h) of title 18, United States Code, is 
     amended--
       (1) in paragraph (1), by striking ``90 days'' and inserting 
     ``1 year''; and
       (2) by adding at the end the following:
       ``(5) Extension of preservation.--A provider of a report to 
     the CyberTipline under subsection (a)(1) may voluntarily 
     preserve the contents provided in the report (including any 
     comingled content described in paragraph (2)) for longer than 
     1 year after the submission to the CyberTipline for the 
     purpose of reducing the proliferation of online child sexual 
     exploitation or preventing the online sexual exploitation of 
     children.
       ``(6) Method of preservation.--Not later than 1 year after 
     the date of enactment of this paragraph, a provider of a 
     report to the CyberTipline under subsection (a)(1) shall 
     preserve materials under this subsection in a manner that is 
     consistent with the most recent version of the Cybersecurity 
     Framework developed by the National Institute of Standards 
     and Technology, or any successor thereto.''.

     SEC. 4. STRENGTHENING OF DUTY TO REPORT APPARENT VIOLATIONS 
                   TO CYBERTIPLINE RELATED TO ONLINE EXPLOITATION 
                   OF CHILDREN.

       (a) Amendments.--Section 2258A of title 18, United States 
     Code, is amended--
       (1) in subsection (a)(2)(A), by inserting ``, of section 
     1591 (if the violation involves a minor), or of 2422(b)'' 
     after ``child pornography''; and
       (2) in subsection (e)--
       (A) in paragraph (1), by striking ``$150,000'' and 
     inserting ``$850,000 in the case of a provider with not less 
     than 100,000,000 monthly active users or $600,000 in the case 
     of a provider with less than 100,000,000 monthly active 
     users''; and
       (B) in paragraph (2), by striking ``$300,000'' and 
     inserting ``$1,000,000 in the case of a provider with not 
     less than 100,000,000 monthly active users or $850,000 in the 
     case of a provider with less than 100,000,000 monthly active 
     users''.
       (b) Guidelines.--Not later than 180 days after the date of 
     enactment of this Act, the National Center for Missing & 
     Exploited Children may issue guidelines, as appropriate, to 
     providers required or permitted to take actions described in 
     section 2258A(a)(1)(B) of title 18, United States Code, on 
     the relevant identifiers for content that may indicate sex 
     trafficking of children, as described in section 1591 of that 
     title, or enticement, as described in section 2422(b) of that 
     title.

  Mr. WYDEN. Mr. President, I expect that the Senate will soon pass by 
unanimous consent the Blackburn-Ossoff REPORT Act. This bill will 
strengthen the Nation's centralized reporting system for the online 
exploitation of children, operated by the National Center for Missing 
and Exploited Children, to better protect children from online sexual 
abuse and exploitation. Senators Blackburn and Ossoff worked closely 
with me to make important changes to this bill to require that the 
upgraded CyberTipline be secured consistent with Federal cybersecurity 
best practices, so that hackers are not able to steal and then 
distribute the extremely sensitive images and videos documenting abuse 
that are stored in this system. I sincerely appreciate their 
partnership on this important issue.
  Mr. SCHUMER. I ask unanimous consent that the committee-reported 
amendment be withdrawn; that the Blackburn substitute amendment at the 
desk be considered and agreed to; that the bill, as amended, be 
considered read a third time and passed; and that the motion to 
reconsider be considered made and laid upon the table.
  The PRESIDING OFFICER. Without objection, it is so ordered.
  The committee-reported amendment in the nature of a substitute was 
withdrawn.
  The amendment (No. 1377) in the nature of a substitute was agreed to, 
as follows:

                (Purpose: In the nature of a substitute)

        Strike all after the enacting clause and insert the 
     following:

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``Revising Existing Procedures 
     On Reporting via Technology Act'' or the ``REPORT Act''.

     SEC. 2. LIMITED LIABILITY MODERNIZATION.

       (a) Amendments.--Section 2258B of title 18, United States 
     Code, is amended--
       (1) in the section heading, by striking ``providers or 
     domain name registrars'' and inserting ``the reporting, 
     storage, and handling of certain visual depictions of 
     apparent child pornography to the National Center for Missing 
     & Exploited Children'';
       (2) in subsection (b)--
       (A) in the matter preceding paragraph (1), by inserting 
     ``or charge'' after ``a claim''; and
       (B) in paragraph (2)(C), by striking ``this section,''; and
       (3) by adding at the end the following:
       ``(d) Limited Liability for NCMEC-Contracted Vendors.--
       ``(1) In general.--Except as provided in paragraph (2), a 
     civil claim or criminal charge may not be brought in any 
     Federal or State court against a vendor contractually 
     retained and designated by NCMEC to support the duties of 
     NCMEC under section 404(b)(1)(K) of the Juvenile Justice and 
     Delinquency Prevention Act of 1974 (34 U.S.C. 
     11293(b)(1)(K)).
       ``(2) Intentional, reckless, or other misconduct.--
     Paragraph (1) shall not apply to a claim or charge if the 
     vendor--
       ``(A) engaged in--
       ``(i) intentional misconduct; or
       ``(ii) negligent conduct; or
       ``(B) acted, or failed to act--
       ``(i) with actual malice;
       ``(ii) with reckless disregard to a substantial risk of 
     causing injury without legal justification; or
       ``(iii) for a purpose unrelated to the performance of any 
     responsibility or function--

       ``(I) set forth in paragraph (1); or
       ``(II) pursuant to sections 2258A, 2258C, 2702, or 2703.

       ``(3) Vendor cybersecurity requirements.--With respect to 
     any visual depiction provided pursuant to the duties of NCMEC 
     under section 404(b)(1)(K) of the Juvenile Justice and 
     Delinquency Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K)) 
     that is stored or transferred by a vendor contractually 
     retained and designated by NCMEC to support such duties of 
     NCMEC, a vendor shall--
       ``(A) secure such visual depiction in a manner that is 
     consistent with the most recent

[[Page S6008]]

     version of the Cybersecurity Framework developed by the 
     National Institute of Standards and Technology, or any 
     successor thereto;
       ``(B) minimize the number of employees that may be able to 
     obtain access to such visual depiction;
       ``(C) employ end-to-end encryption for data storage and 
     transfer functions, or an equivalent technological standard;
       ``(D) undergo an independent annual cybersecurity audit to 
     determine whether such visual depiction is secured as 
     required under subparagraph (A); and
       ``(E) promptly address all issues identified by an audit 
     described in subparagraph (D).
       ``(e) Limited Liability for Reporting Apparent Child 
     Pornography by an Individual Depicted in the Child 
     Pornography as a Minor, or a Representative of Such 
     Individual.--
       ``(1) In general.--Except as provided in paragraph (2), a 
     civil claim or criminal charge may not be brought in any 
     Federal or State court against an individual depicted in 
     child pornography as a minor, or a representative of such 
     individual, arising from a report to the NCMEC CyberTipline 
     by the individual, or the representative of such individual, 
     of information that relates to the child pornography in which 
     the individual is depicted as a minor, including a copy of 
     the child pornography.
       ``(2) Intentional, reckless, or other misconduct.--
     Paragraph (1) shall not apply to a claim or charge if the 
     individual, or the representative of such individual--
       ``(A) engaged in--
       ``(i) intentional misconduct;
       ``(ii) negligent conduct; or
       ``(iii) any activity which constitutes a violation of 
     section 2251; or
       ``(B) acted, or failed to act--
       ``(i) with actual malice; or
       ``(ii) with reckless disregard to a substantial risk of 
     causing injury without legal justification.
       ``(3) Minimizing access.--With respect to any child 
     pornography reported to the NCMEC CyberTipline by an 
     individual depicted in the child pornography as a minor, or a 
     representative of such individual, NCMEC shall minimize 
     access to the child pornography and ensure the appropriate 
     deletion of the child pornography, as set forth in section 
     2258D.
       ``(4) Definition.--For purposes of this subsection, the 
     term `representative', with respect to an individual depicted 
     in child pornography--
       ``(A) means--
       ``(i) the parent or legal guardian of the individual, if 
     the individual is under 18 years of age;
       ``(ii) the legal guardian or other person appointed by a 
     court to represent the individual;
       ``(iii) a legal representative retained by the individual;
       ``(iv) a representative of the estate of the individual; or
       ``(v) a person who is a mandated reporter under section 
     226(a)(1) of the Victims of Child Abuse Act of 1990 (34 
     U.S.C. 20341(a)(1)); and
       ``(B) does not include a person who engaged in any activity 
     which constitutes a violation of section 2251.''.
       (b) Applicability.--The amendments made by subsection (a) 
     shall apply with respect to a civil claim or criminal charge 
     that is filed on or after the date of enactment of this Act.
       (c) Table of Sections Amendment.--The table of sections for 
     chapter 110 of title 18, United States Code, is amended by 
     striking the item relating to section 2258B and inserting the 
     following:

``2258B. Limited liability for the reporting, storage, and handling of 
              certain visual depictions of apparent child pornography 
              to the National Center for Missing & Exploited 
              Children.''.

     SEC. 3. PRESERVATION OF REPORTS TO CYBERTIPLINE RELATED TO 
                   ONLINE SEXUAL EXPLOITATION OF CHILDREN.

       Section 2258A(h) of title 18, United States Code, is 
     amended--
       (1) in paragraph (1), by striking ``90 days'' and inserting 
     ``1 year''; and
       (2) by adding at the end the following:
       ``(5) Extension of preservation.--A provider of a report to 
     the CyberTipline under subsection (a)(1) may voluntarily 
     preserve the contents provided in the report (including any 
     comingled content described in paragraph (2)) for longer than 
     1 year after the submission to the CyberTipline for the 
     purpose of reducing the proliferation of online child sexual 
     exploitation or preventing the online sexual exploitation of 
     children.
       ``(6) Method of preservation.--Not later than 1 year after 
     the date of enactment of this paragraph, a provider of a 
     report to the CyberTipline under subsection (a)(1) shall 
     preserve materials under this subsection in a manner that is 
     consistent with the most recent version of the Cybersecurity 
     Framework developed by the National Institute of Standards 
     and Technology, or any successor thereto.''.

     SEC. 4. STRENGTHENING OF DUTY TO REPORT APPARENT VIOLATIONS 
                   TO CYBERTIPLINE RELATED TO ONLINE EXPLOITATION 
                   OF CHILDREN.

       (a) Amendments.--Section 2258A of title 18, United States 
     Code, is amended--
       (1) in subsection (a)(2)(A), by inserting ``, of section 
     1591 (if the violation involves a minor), or of 2422(b)'' 
     after ``child pornography''; and
       (2) in subsection (e)--
       (A) in paragraph (1), by striking ``$150,000'' and 
     inserting ``$850,000 in the case of a provider with not less 
     than 100,000,000 monthly active users or $600,000 in the case 
     of a provider with less than 100,000,000 monthly active 
     users''; and
       (B) in paragraph (2), by striking ``$300,000'' and 
     inserting ``$1,000,000 in the case of a provider with not 
     less than 100,000,000 monthly active users or $850,000 in the 
     case of a provider with less than 100,000,000 monthly active 
     users''.
       (b) Guidelines.--Not later than 180 days after the date of 
     enactment of this Act, the National Center for Missing & 
     Exploited Children may issue guidelines, as appropriate, to 
     providers required or permitted to take actions described in 
     section 2258A(a)(1)(B) of title 18, United States Code, on 
     the relevant identifiers for content that may indicate sex 
     trafficking of children, as described in section 1591 of that 
     title, or enticement, as described in section 2422(b) of that 
     title.
  The bill (S. 474), as amended, was ordered to be engrossed for a 
third reading, was read the third time, and passed.

                          ____________________