[Congressional Record Volume 170, Number 120 (Wednesday, July 24, 2024)]
[Senate]
[Pages S5386-S5388]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 3076. Mr. MARSHALL (for himself and Mrs. Shaheen) submitted an 
amendment intended to be proposed by him to the bill S. 2073, to amend 
title 31, United States Code, to require agencies to include a list of 
outdated or duplicative reporting requirements in annual budget 
justifications, and for other purposes; which was ordered to lie on the 
table; as follows:

        At the appropriate place, insert the following:

              TITLE __--COOPER DAVIS AND DEVIN NORRING ACT

     SEC. __01. SHORT TITLE.

       This title may be cited as the ``Cooper Davis and Devin 
     Norring Act''.

     SEC. __02. REPORTING REQUIREMENTS OF ELECTRONIC COMMUNICATION 
                   SERVICE PROVIDERS AND REMOTE COMPUTING SERVICES 
                   FOR CERTAIN CONTROLLED SUBSTANCES VIOLATIONS.

       (a) Amendments to Controlled Substances Act.--
       (1) In general.--Part E of the Controlled Substances Act 
     (21 U.S.C. 871 et seq.) is amended by adding at the end the 
     following:


``reporting requirements of electronic communication service providers 
    and remote computing services for certain controlled substances 
                               violations

       ``Sec. 521.  (a) Definitions.--In this section--
       ``(1) the term `electronic communication service' has the 
     meaning given that term in section 2510 of title 18, United 
     States Code;
       ``(2) the term `electronic mail address' has the meaning 
     given that term in section 3 of the CAN-SPAM Act of 2003 (15 
     U.S.C. 7702);
       ``(3) the term `Internet' has the meaning given that term 
     in section 1101 of the Internet Tax Freedom Act (47 U.S.C. 
     151 note);
       ``(4) the term `provider' means an electronic communication 
     service provider or remote computing service;
       ``(5) the term `remote computing service' has the meaning 
     given that term in section 2711 of title 18, United States 
     Code; and
       ``(6) the term `website' means any collection of material 
     placed in a computer server-based file archive so that it is 
     publicly accessible, over the Internet, using hypertext 
     transfer protocol or any successor protocol.
       ``(b) Duty to Report.--
       ``(1) General duty.--In order to reduce the proliferation 
     of the unlawful sale, distribution, or manufacture (as 
     applicable) of counterfeit substances and certain controlled 
     substances, a provider shall, as soon as reasonably possible 
     after obtaining actual knowledge of any facts or 
     circumstances described in paragraph (2), and in any event 
     not later than 60 days after obtaining such knowledge, submit 
     to the Drug Enforcement Administration a report containing--
       ``(A) the mailing address, telephone number, facsimile 
     number, and electronic mailing address of, and individual 
     point of contact for, such provider;
       ``(B) information described in subsection (c) concerning 
     such facts or circumstances; and
       ``(C) for purposes of subsection (j), information 
     indicating whether the facts or circumstances were discovered 
     through content moderation conducted by a human or via a

[[Page S5387]]

     non-human method, including use of an algorithm, machine 
     learning, or other means.
       ``(2) Facts or circumstances.--The facts or circumstances 
     described in this paragraph are any facts or circumstances 
     establishing that a crime is being or has already been 
     committed involving--
       ``(A) creating, manufacturing, distributing, dispensing, or 
     possession with intent to manufacture, distribute, or 
     dispense--
       ``(i) fentanyl; or
       ``(ii) methamphetamine;
       ``(B) creating, manufacturing, distributing, dispensing, or 
     possession with intent to manufacture, distribute, or 
     dispense a counterfeit substance, including a counterfeit 
     substance purporting to be a prescription drug; or
       ``(C) offering, dispensing, or administering an actual or 
     purported prescription pain medication or prescription 
     stimulant by any individual or entity that is not a 
     practitioner or online pharmacy, including an individual or 
     entity that falsely claims to be a practitioner or online 
     pharmacy.
       ``(3) Permitted actions based on reasonable belief.--In 
     order to reduce the proliferation of the unlawful sale, 
     distribution, or manufacture (as applicable) of counterfeit 
     substances and certain controlled substances, if a provider 
     has a reasonable belief that facts or circumstances described 
     in paragraph (2) exist, the provider may submit to the Drug 
     Enforcement Administration a report described in paragraph 
     (1).
       ``(c) Contents of Report.--
       ``(1) In general.--To the extent the information is within 
     the custody or control of a provider, the facts or 
     circumstances included in each report under subsection 
     (b)(1)--
       ``(A) shall include, to the extent that it is applicable 
     and reasonably available, information relating to the account 
     involved in the commission of a crime described in subsection 
     (b)(2), such as the name, address, electronic mail address, 
     user or account identification, Internet Protocol address, 
     uniform resource locator, screen names or monikers for the 
     account used or any other accounts associated with the 
     account user, or any other identifying information, including 
     self-reported identifying information, but not including the 
     contents of a wire communication or electronic communication, 
     as those terms are defined in section 2510 of title 18, 
     United States Code, except as provided in subparagraph (B) of 
     this paragraph; and
       ``(B) may, at the sole discretion of the provider, include 
     the information described in paragraph (2) of this 
     subsection.
       ``(2) Other information.--The information referred to in 
     paragraph (1)(B) is the following:
       ``(A) Historical reference.--Information relating to when 
     and how a user, subscriber, or customer of a provider 
     uploaded, transmitted, or received content relating to the 
     report or when and how content relating to the report was 
     reported to or discovered by the provider, including a date 
     and time stamp and time zone.
       ``(B) Geographic location information.--Information 
     relating to the geographic location of the involved 
     individual or website, which may include the Internet 
     Protocol address or verified address, or, if not reasonably 
     available, at least one form of geographic identifying 
     information, including area code or ZIP Code, provided by the 
     user, subscriber, or customer, or stored or obtained by the 
     provider, and any information as to whether a virtual private 
     network was used.
       ``(C) Data relating to facts or circumstances.--Any data, 
     including symbols, photos, video, icons, or direct messages, 
     relating to activity involving the facts or circumstances 
     described in subsection (b)(2) or other content relating to 
     the crime.
       ``(D) Complete communication.--The complete communication 
     containing the information of the crime described in 
     subsection (b)(2), including--
       ``(i) any data or information regarding the transmission of 
     the communication; and
       ``(ii) any data or other digital files contained in, or 
     attached to, the communication.
       ``(3) User, subscriber, or customer submitted reports.--In 
     the case of a report under subsection (b)(3), the provider 
     may, at its sole discretion, include in the report 
     information submitted to the provider by a user, subscriber, 
     or customer alleging facts or circumstances described in 
     subsection (b)(2) if the provider, upon review, has a 
     reasonable belief that the alleged facts or circumstances 
     exist.
       ``(d) Handling of Reports.--Upon receipt of a report 
     submitted under subsection (b), the Drug Enforcement 
     Administration--
       ``(1) shall conduct a preliminary review of such report; 
     and
       ``(2) after completing the preliminary review, shall--
       ``(A) conduct further investigation of the report, which 
     may include making the report available to other Federal, 
     State, or local law enforcement agencies involved in the 
     investigation of crimes described in subsection (b)(2), if 
     the Drug Enforcement Administration determines that the 
     report facially contains sufficient information to warrant 
     and permit further investigation; or
       ``(B) conclude that no further investigative steps are 
     warranted or possible, or that insufficient evidence exists 
     to make a determination, and close the report.
       ``(e) Attorney General Responsibilities.--
       ``(1) In general.--The Attorney General shall enforce this 
     section.
       ``(2) Designation of federal agencies.--The Attorney 
     General may designate a Federal law enforcement agency or 
     agencies to which the Drug Enforcement Administration may 
     forward a report under subsection (d).
       ``(3) Data minimization requirements.--The Attorney General 
     shall take reasonable measures to--
       ``(A) limit the storage of a report submitted under 
     subsection (b) and its contents to the amount that is 
     necessary to carry out the investigation of crimes described 
     in subsection (b)(2); and
       ``(B) store a report submitted under subsection (b) and its 
     contents only as long as is reasonably necessary to carry out 
     an investigation of crimes described in subsection (b)(2) or 
     make the report available to other agencies under subsection 
     (d)(2)(A), after which time the report and its contents shall 
     be deleted unless the preservation of a report has future 
     evidentiary value.
       ``(f) Failure to Comply With Requirements.--
       ``(1) Criminal penalty.--
       ``(A) Offense.--It shall be unlawful for a provider to 
     knowingly fail to submit a report required under subsection 
     (b)(1).
       ``(B) Penalty.--A provider that violates subparagraph (A) 
     shall be fined--
       ``(i) in the case of an initial violation, not more than 
     $190,000; and
       ``(ii) in the case of any second or subsequent violation, 
     not more than $380,000.
       ``(2) Civil penalty.--In addition to any other available 
     civil or criminal penalty, a provider shall be liable to the 
     United States Government for a civil penalty in an amount not 
     less than $50,000 and not more than $100,000 if the provider 
     knowingly submits a report under subsection (b) that--
       ``(A) contains materially false or fraudulent information; 
     or
       ``(B) omits information described in subsection (c)(1)(A) 
     that is reasonably available.
       ``(g) Protection of Privacy.--Nothing in this section shall 
     be construed to--
       ``(1) require a provider to monitor any user, subscriber, 
     or customer of that provider;
       ``(2) require a provider to monitor the content of any 
     communication of any person described in paragraph (1);
       ``(3) require a provider to affirmatively search, screen, 
     or scan for facts or circumstances described in subsection 
     (b)(2); or
       ``(4) permit actual knowledge to be proven based solely on 
     a provider's decision not to engage in additional 
     verification or investigation to discover facts and 
     circumstances that are not readily apparent, so long as the 
     provider does not deliberately blind itself to those 
     violations.
       ``(h) Conditions of Disclosure of Information Contained 
     Within Report.--
       ``(1) In general.--Except as provided in paragraph (2), a 
     law enforcement agency that receives a report under 
     subsection (d) shall not disclose any information contained 
     in that report.
       ``(2) Permitted disclosures by law enforcement.--A law 
     enforcement agency may disclose information in a report 
     received under subsection (d)--
       ``(A) to an attorney for the government for use in the 
     performance of the official duties of that attorney, 
     including providing discovery to a defendant;
       ``(B) to such officers and employees of that law 
     enforcement agency, as may be necessary in the performance of 
     their investigative and recordkeeping functions;
       ``(C) to such other government personnel (including 
     personnel of a State or subdivision of a State) as are 
     determined to be necessary by an attorney for the government 
     to assist the attorney in the performance of the official 
     duties of the attorney in enforcing Federal criminal law;
       ``(D) if the report discloses an apparent violation of 
     State criminal law, to an appropriate official of a State or 
     subdivision of a State for the purpose of enforcing such 
     State law;
       ``(E) to a defendant in a criminal case or the attorney for 
     that defendant to the extent the information relates to a 
     criminal charge pending against that defendant;
       ``(F) to a provider if necessary to facilitate response to 
     legal process issued in connection to a criminal 
     investigation, prosecution, or post-conviction remedy 
     relating to that report;
       ``(G) as ordered by a court upon a showing of good cause 
     and pursuant to any protective orders or other conditions 
     that the court may impose; and
       ``(H) in order to facilitate the enforcement of the 
     penalties authorized under subsection (f).
       ``(i) Preservation.--
       ``(1) In general.--
       ``(A) Request to preserve contents.--
       ``(i) In general.--Subject to clause (ii), for the purposes 
     of this section, a completed submission by a provider of a 
     report to the Drug Enforcement Administration under 
     subsection (b)(1) shall be treated as a request to preserve 
     the contents provided in the report, and any data or other 
     digital files that are reasonably accessible and may provide 
     context or additional information about the reported material 
     or person, for 90 days after the submission to the Drug 
     Enforcement Administration.
       ``(ii) Limitations on extension of preservation period.--

       ``(I) Stored communications act.--The Drug Enforcement 
     Administration may not submit a request to a provider to 
     continue preservation of the contents of a report or

[[Page S5388]]

     other data described in clause (i) under section 2703(f) of 
     title 18, United States Code, beyond the required period of 
     preservation under clause (i) of this subparagraph unless the 
     Drug Enforcement Administration has an active or pending 
     investigation involving the user, subscriber, or customer 
     account at issue in the report.
       ``(II) Rule of construction.--Nothing in subclause (I) 
     shall preclude another Federal, State, or local law 
     enforcement agency from seeking continued preservation of the 
     contents of a report or other data described in clause (i) 
     under section 2703(f) of title 18, United States Code.

       ``(B) Notification to user.--A provider may not notify a 
     user, subscriber, or customer of the provider of a 
     preservation request described in subparagraph (A) unless--
       ``(i) the provider has notified the Drug Enforcement 
     Administration of its intent to provide that notice; and
       ``(ii) 45 business days have elapsed since the notification 
     under clause (i).
       ``(2) Protection of preserved materials.--A provider 
     preserving materials under this section shall maintain the 
     materials in a secure location and take appropriate steps to 
     limit access to the materials by agents or employees of the 
     service to that access necessary to comply with the 
     requirements of this subsection.
       ``(3) Authorities and duties not affected.--Nothing in this 
     section shall be construed as replacing, amending, or 
     otherwise interfering with the authorities and duties under 
     section 2703 of title 18, United States Code.
       ``(4) Relation to reporting requirement.--Submission of a 
     report as required by subsection (b)(1) does not satisfy the 
     obligations under this subsection.
       ``(j) Annual Report.--Not later than 1 year after the date 
     of enactment of the Cooper Davis and Devin Norring Act, and 
     annually thereafter, the Drug Enforcement Administration 
     shall publish a report that includes, for the reporting 
     period--
       ``(1) the total number of reports received from providers 
     under subsection (b)(1);
       ``(2) the number of reports received under subsection 
     (b)(1) disaggregated by--
       ``(A) the provider on whose electronic communication 
     service or remote computing service the crime for which there 
     are facts or circumstances occurred; and
       ``(B) the subsidiary of a provider, if any, on whose 
     electronic communication service or remote computing service 
     the crime for which there are facts or circumstances 
     occurred;
       ``(3) the number of reports received under subsection 
     (b)(1) that led to convictions in cases investigated by the 
     Drug Enforcement Administration;
       ``(4) the number of reports received under subsection 
     (b)(1) that lacked actionable information;
       ``(5) the number of reports received under subsection 
     (b)(1) where the facts or circumstances of a crime were 
     discovered through--
       ``(A) content moderation conducted by a human; or
       ``(B) a non-human method including use of an algorithm, 
     machine learning, or other means;
       ``(6) the number of reports received under subsection 
     (b)(1) that were made available to other law enforcement 
     agencies, disaggregated by--
       ``(A) the number of reports made available to Federal law 
     enforcement agencies;
       ``(B) the number of reports made available to State law 
     enforcement agencies; and
       ``(C) the number of reports made available to local law 
     enforcement agencies; and
       ``(7) the number of requests to providers to continue 
     preservation of the contents of a report or other data 
     described in subsection (i)(1)(A)(i) submitted by the Drug 
     Enforcement Administration under section 2703(f) of title 18, 
     United States Code.
       ``(k) Prohibition on Submission of User, Subscriber, 
     Customer, or Anonymous Reports by Law Enforcement.--
       ``(1) In general.--No Federal, Tribal, State, or local law 
     enforcement officer acting in an official capacity may submit 
     a report to a provider or arrange for another individual to 
     submit a report to a provider on behalf of the officer under 
     this section.
       ``(2) Remedy for violation.--No part of the contents of a 
     provider's report made under subsection (b)(1) or (b)(3) and 
     no evidence derived therefrom may be received in evidence in 
     any trial, hearing, or other proceeding in or before any 
     court, department, officer, agency, regulatory body, 
     legislative committee, or other authority of the United 
     States, a State, or a political subdivision thereof if that 
     provider report resulted from an action prohibited by 
     paragraph (1) of this subsection.
       ``(l) Exemptions.--Subsections (b) through (k) shall not 
     apply to a provider of broadband internet access service, as 
     that term is defined in section 8.1(b) of title 47, Code of 
     Federal Regulations (or any successor regulation), or a 
     provider of a text messaging service, as that term is defined 
     in section 227 of the Communications Act of 1934 (47 U.S.C. 
     227), insofar as the provider is acting as a provider of such 
     service.''.
       (2) Technical and conforming amendment.--The table of 
     contents for the Controlled Substances Act (21 U.S.C. 801 et 
     seq.) is amended by inserting after the item relating to 
     section 520 the following:

``Sec. 521. Reporting requirements of electronic communication service 
              providers and remote computing services for certain 
              controlled substances violations.''.
       (b) Conforming Amendments to Stored Communications Act.--
       (1) In general.--Section 2702 of title 18, United States 
     Code, is amended--
       (A) in subsection (b)--
       (i) in paragraph (8), by striking ``or'' at the end;
       (ii) in paragraph (9), by striking the period at the end 
     and inserting ``; or''; and
       (iii) by adding at the end the following:
       ``(10) to the Drug Enforcement Administration, in 
     connection with a report submitted thereto under section 521 
     of the Controlled Substances Act.''; and
       (B) in subsection (c)--
       (i) in paragraph (6), by striking ``or'' at the end;
       (ii) in paragraph (7), by striking the period at the end 
     and inserting ``; or''; and
       (iii) by adding at the end the following:
       ``(8) to the Drug Enforcement Administration, in connection 
     with a report submitted thereto under section 521 of the 
     Controlled Substances Act.''.
       (2) Technical amendment.--Paragraph (7) of section 2702(b) 
     of title 18, United States Code, is amended to read as 
     follows:
       ``(7) to a law enforcement agency if the contents--
       ``(A) were inadvertently obtained by the service provider; 
     and
       ``(B) appear to pertain to the commission of a crime;''.

     SEC. __03. SEVERABILITY.

       If any provision of this Act or amendment made by this Act, 
     or the application of such a provision or amendment to any 
     person or circumstance, is held to be unconstitutional, the 
     remaining provisions of this Act and amendments made by this 
     Act, and the application of such provision or amendment to 
     any other person or circumstance, shall not be affected 
     thereby.
                                 ______