[Congressional Record Volume 170, Number 120 (Wednesday, July 24, 2024)]
[Senate]
[Pages S5386-S5388]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
SA 3076. Mr. MARSHALL (for himself and Mrs. Shaheen) submitted an
amendment intended to be proposed by him to the bill S. 2073, to amend
title 31, United States Code, to require agencies to include a list of
outdated or duplicative reporting requirements in annual budget
justifications, and for other purposes; which was ordered to lie on the
table; as follows:
At the appropriate place, insert the following:
TITLE __--COOPER DAVIS AND DEVIN NORRING ACT
SEC. __01. SHORT TITLE.
This title may be cited as the ``Cooper Davis and Devin
Norring Act''.
SEC. __02. REPORTING REQUIREMENTS OF ELECTRONIC COMMUNICATION
SERVICE PROVIDERS AND REMOTE COMPUTING SERVICES
FOR CERTAIN CONTROLLED SUBSTANCES VIOLATIONS.
(a) Amendments to Controlled Substances Act.--
(1) In general.--Part E of the Controlled Substances Act
(21 U.S.C. 871 et seq.) is amended by adding at the end the
following:
``reporting requirements of electronic communication service providers
and remote computing services for certain controlled substances
violations
``Sec. 521. (a) Definitions.--In this section--
``(1) the term `electronic communication service' has the
meaning given that term in section 2510 of title 18, United
States Code;
``(2) the term `electronic mail address' has the meaning
given that term in section 3 of the CAN-SPAM Act of 2003 (15
U.S.C. 7702);
``(3) the term `Internet' has the meaning given that term
in section 1101 of the Internet Tax Freedom Act (47 U.S.C.
151 note);
``(4) the term `provider' means an electronic communication
service provider or remote computing service;
``(5) the term `remote computing service' has the meaning
given that term in section 2711 of title 18, United States
Code; and
``(6) the term `website' means any collection of material
placed in a computer server-based file archive so that it is
publicly accessible, over the Internet, using hypertext
transfer protocol or any successor protocol.
``(b) Duty to Report.--
``(1) General duty.--In order to reduce the proliferation
of the unlawful sale, distribution, or manufacture (as
applicable) of counterfeit substances and certain controlled
substances, a provider shall, as soon as reasonably possible
after obtaining actual knowledge of any facts or
circumstances described in paragraph (2), and in any event
not later than 60 days after obtaining such knowledge, submit
to the Drug Enforcement Administration a report containing--
``(A) the mailing address, telephone number, facsimile
number, and electronic mailing address of, and individual
point of contact for, such provider;
``(B) information described in subsection (c) concerning
such facts or circumstances; and
``(C) for purposes of subsection (j), information
indicating whether the facts or circumstances were discovered
through content moderation conducted by a human or via a
[[Page S5387]]
non-human method, including use of an algorithm, machine
learning, or other means.
``(2) Facts or circumstances.--The facts or circumstances
described in this paragraph are any facts or circumstances
establishing that a crime is being or has already been
committed involving--
``(A) creating, manufacturing, distributing, dispensing, or
possession with intent to manufacture, distribute, or
dispense--
``(i) fentanyl; or
``(ii) methamphetamine;
``(B) creating, manufacturing, distributing, dispensing, or
possession with intent to manufacture, distribute, or
dispense a counterfeit substance, including a counterfeit
substance purporting to be a prescription drug; or
``(C) offering, dispensing, or administering an actual or
purported prescription pain medication or prescription
stimulant by any individual or entity that is not a
practitioner or online pharmacy, including an individual or
entity that falsely claims to be a practitioner or online
pharmacy.
``(3) Permitted actions based on reasonable belief.--In
order to reduce the proliferation of the unlawful sale,
distribution, or manufacture (as applicable) of counterfeit
substances and certain controlled substances, if a provider
has a reasonable belief that facts or circumstances described
in paragraph (2) exist, the provider may submit to the Drug
Enforcement Administration a report described in paragraph
(1).
``(c) Contents of Report.--
``(1) In general.--To the extent the information is within
the custody or control of a provider, the facts or
circumstances included in each report under subsection
(b)(1)--
``(A) shall include, to the extent that it is applicable
and reasonably available, information relating to the account
involved in the commission of a crime described in subsection
(b)(2), such as the name, address, electronic mail address,
user or account identification, Internet Protocol address,
uniform resource locator, screen names or monikers for the
account used or any other accounts associated with the
account user, or any other identifying information, including
self-reported identifying information, but not including the
contents of a wire communication or electronic communication,
as those terms are defined in section 2510 of title 18,
United States Code, except as provided in subparagraph (B) of
this paragraph; and
``(B) may, at the sole discretion of the provider, include
the information described in paragraph (2) of this
subsection.
``(2) Other information.--The information referred to in
paragraph (1)(B) is the following:
``(A) Historical reference.--Information relating to when
and how a user, subscriber, or customer of a provider
uploaded, transmitted, or received content relating to the
report or when and how content relating to the report was
reported to or discovered by the provider, including a date
and time stamp and time zone.
``(B) Geographic location information.--Information
relating to the geographic location of the involved
individual or website, which may include the Internet
Protocol address or verified address, or, if not reasonably
available, at least one form of geographic identifying
information, including area code or ZIP Code, provided by the
user, subscriber, or customer, or stored or obtained by the
provider, and any information as to whether a virtual private
network was used.
``(C) Data relating to facts or circumstances.--Any data,
including symbols, photos, video, icons, or direct messages,
relating to activity involving the facts or circumstances
described in subsection (b)(2) or other content relating to
the crime.
``(D) Complete communication.--The complete communication
containing the information of the crime described in
subsection (b)(2), including--
``(i) any data or information regarding the transmission of
the communication; and
``(ii) any data or other digital files contained in, or
attached to, the communication.
``(3) User, subscriber, or customer submitted reports.--In
the case of a report under subsection (b)(3), the provider
may, at its sole discretion, include in the report
information submitted to the provider by a user, subscriber,
or customer alleging facts or circumstances described in
subsection (b)(2) if the provider, upon review, has a
reasonable belief that the alleged facts or circumstances
exist.
``(d) Handling of Reports.--Upon receipt of a report
submitted under subsection (b), the Drug Enforcement
Administration--
``(1) shall conduct a preliminary review of such report;
and
``(2) after completing the preliminary review, shall--
``(A) conduct further investigation of the report, which
may include making the report available to other Federal,
State, or local law enforcement agencies involved in the
investigation of crimes described in subsection (b)(2), if
the Drug Enforcement Administration determines that the
report facially contains sufficient information to warrant
and permit further investigation; or
``(B) conclude that no further investigative steps are
warranted or possible, or that insufficient evidence exists
to make a determination, and close the report.
``(e) Attorney General Responsibilities.--
``(1) In general.--The Attorney General shall enforce this
section.
``(2) Designation of federal agencies.--The Attorney
General may designate a Federal law enforcement agency or
agencies to which the Drug Enforcement Administration may
forward a report under subsection (d).
``(3) Data minimization requirements.--The Attorney General
shall take reasonable measures to--
``(A) limit the storage of a report submitted under
subsection (b) and its contents to the amount that is
necessary to carry out the investigation of crimes described
in subsection (b)(2); and
``(B) store a report submitted under subsection (b) and its
contents only as long as is reasonably necessary to carry out
an investigation of crimes described in subsection (b)(2) or
make the report available to other agencies under subsection
(d)(2)(A), after which time the report and its contents shall
be deleted unless the preservation of a report has future
evidentiary value.
``(f) Failure to Comply With Requirements.--
``(1) Criminal penalty.--
``(A) Offense.--It shall be unlawful for a provider to
knowingly fail to submit a report required under subsection
(b)(1).
``(B) Penalty.--A provider that violates subparagraph (A)
shall be fined--
``(i) in the case of an initial violation, not more than
$190,000; and
``(ii) in the case of any second or subsequent violation,
not more than $380,000.
``(2) Civil penalty.--In addition to any other available
civil or criminal penalty, a provider shall be liable to the
United States Government for a civil penalty in an amount not
less than $50,000 and not more than $100,000 if the provider
knowingly submits a report under subsection (b) that--
``(A) contains materially false or fraudulent information;
or
``(B) omits information described in subsection (c)(1)(A)
that is reasonably available.
``(g) Protection of Privacy.--Nothing in this section shall
be construed to--
``(1) require a provider to monitor any user, subscriber,
or customer of that provider;
``(2) require a provider to monitor the content of any
communication of any person described in paragraph (1);
``(3) require a provider to affirmatively search, screen,
or scan for facts or circumstances described in subsection
(b)(2); or
``(4) permit actual knowledge to be proven based solely on
a provider's decision not to engage in additional
verification or investigation to discover facts and
circumstances that are not readily apparent, so long as the
provider does not deliberately blind itself to those
violations.
``(h) Conditions of Disclosure of Information Contained
Within Report.--
``(1) In general.--Except as provided in paragraph (2), a
law enforcement agency that receives a report under
subsection (d) shall not disclose any information contained
in that report.
``(2) Permitted disclosures by law enforcement.--A law
enforcement agency may disclose information in a report
received under subsection (d)--
``(A) to an attorney for the government for use in the
performance of the official duties of that attorney,
including providing discovery to a defendant;
``(B) to such officers and employees of that law
enforcement agency, as may be necessary in the performance of
their investigative and recordkeeping functions;
``(C) to such other government personnel (including
personnel of a State or subdivision of a State) as are
determined to be necessary by an attorney for the government
to assist the attorney in the performance of the official
duties of the attorney in enforcing Federal criminal law;
``(D) if the report discloses an apparent violation of
State criminal law, to an appropriate official of a State or
subdivision of a State for the purpose of enforcing such
State law;
``(E) to a defendant in a criminal case or the attorney for
that defendant to the extent the information relates to a
criminal charge pending against that defendant;
``(F) to a provider if necessary to facilitate response to
legal process issued in connection to a criminal
investigation, prosecution, or post-conviction remedy
relating to that report;
``(G) as ordered by a court upon a showing of good cause
and pursuant to any protective orders or other conditions
that the court may impose; and
``(H) in order to facilitate the enforcement of the
penalties authorized under subsection (f).
``(i) Preservation.--
``(1) In general.--
``(A) Request to preserve contents.--
``(i) In general.--Subject to clause (ii), for the purposes
of this section, a completed submission by a provider of a
report to the Drug Enforcement Administration under
subsection (b)(1) shall be treated as a request to preserve
the contents provided in the report, and any data or other
digital files that are reasonably accessible and may provide
context or additional information about the reported material
or person, for 90 days after the submission to the Drug
Enforcement Administration.
``(ii) Limitations on extension of preservation period.--
``(I) Stored communications act.--The Drug Enforcement
Administration may not submit a request to a provider to
continue preservation of the contents of a report or
[[Page S5388]]
other data described in clause (i) under section 2703(f) of
title 18, United States Code, beyond the required period of
preservation under clause (i) of this subparagraph unless the
Drug Enforcement Administration has an active or pending
investigation involving the user, subscriber, or customer
account at issue in the report.
``(II) Rule of construction.--Nothing in subclause (I)
shall preclude another Federal, State, or local law
enforcement agency from seeking continued preservation of the
contents of a report or other data described in clause (i)
under section 2703(f) of title 18, United States Code.
``(B) Notification to user.--A provider may not notify a
user, subscriber, or customer of the provider of a
preservation request described in subparagraph (A) unless--
``(i) the provider has notified the Drug Enforcement
Administration of its intent to provide that notice; and
``(ii) 45 business days have elapsed since the notification
under clause (i).
``(2) Protection of preserved materials.--A provider
preserving materials under this section shall maintain the
materials in a secure location and take appropriate steps to
limit access to the materials by agents or employees of the
service to that access necessary to comply with the
requirements of this subsection.
``(3) Authorities and duties not affected.--Nothing in this
section shall be construed as replacing, amending, or
otherwise interfering with the authorities and duties under
section 2703 of title 18, United States Code.
``(4) Relation to reporting requirement.--Submission of a
report as required by subsection (b)(1) does not satisfy the
obligations under this subsection.
``(j) Annual Report.--Not later than 1 year after the date
of enactment of the Cooper Davis and Devin Norring Act, and
annually thereafter, the Drug Enforcement Administration
shall publish a report that includes, for the reporting
period--
``(1) the total number of reports received from providers
under subsection (b)(1);
``(2) the number of reports received under subsection
(b)(1) disaggregated by--
``(A) the provider on whose electronic communication
service or remote computing service the crime for which there
are facts or circumstances occurred; and
``(B) the subsidiary of a provider, if any, on whose
electronic communication service or remote computing service
the crime for which there are facts or circumstances
occurred;
``(3) the number of reports received under subsection
(b)(1) that led to convictions in cases investigated by the
Drug Enforcement Administration;
``(4) the number of reports received under subsection
(b)(1) that lacked actionable information;
``(5) the number of reports received under subsection
(b)(1) where the facts or circumstances of a crime were
discovered through--
``(A) content moderation conducted by a human; or
``(B) a non-human method including use of an algorithm,
machine learning, or other means;
``(6) the number of reports received under subsection
(b)(1) that were made available to other law enforcement
agencies, disaggregated by--
``(A) the number of reports made available to Federal law
enforcement agencies;
``(B) the number of reports made available to State law
enforcement agencies; and
``(C) the number of reports made available to local law
enforcement agencies; and
``(7) the number of requests to providers to continue
preservation of the contents of a report or other data
described in subsection (i)(1)(A)(i) submitted by the Drug
Enforcement Administration under section 2703(f) of title 18,
United States Code.
``(k) Prohibition on Submission of User, Subscriber,
Customer, or Anonymous Reports by Law Enforcement.--
``(1) In general.--No Federal, Tribal, State, or local law
enforcement officer acting in an official capacity may submit
a report to a provider or arrange for another individual to
submit a report to a provider on behalf of the officer under
this section.
``(2) Remedy for violation.--No part of the contents of a
provider's report made under subsection (b)(1) or (b)(3) and
no evidence derived therefrom may be received in evidence in
any trial, hearing, or other proceeding in or before any
court, department, officer, agency, regulatory body,
legislative committee, or other authority of the United
States, a State, or a political subdivision thereof if that
provider report resulted from an action prohibited by
paragraph (1) of this subsection.
``(l) Exemptions.--Subsections (b) through (k) shall not
apply to a provider of broadband internet access service, as
that term is defined in section 8.1(b) of title 47, Code of
Federal Regulations (or any successor regulation), or a
provider of a text messaging service, as that term is defined
in section 227 of the Communications Act of 1934 (47 U.S.C.
227), insofar as the provider is acting as a provider of such
service.''.
(2) Technical and conforming amendment.--The table of
contents for the Controlled Substances Act (21 U.S.C. 801 et
seq.) is amended by inserting after the item relating to
section 520 the following:
``Sec. 521. Reporting requirements of electronic communication service
providers and remote computing services for certain
controlled substances violations.''.
(b) Conforming Amendments to Stored Communications Act.--
(1) In general.--Section 2702 of title 18, United States
Code, is amended--
(A) in subsection (b)--
(i) in paragraph (8), by striking ``or'' at the end;
(ii) in paragraph (9), by striking the period at the end
and inserting ``; or''; and
(iii) by adding at the end the following:
``(10) to the Drug Enforcement Administration, in
connection with a report submitted thereto under section 521
of the Controlled Substances Act.''; and
(B) in subsection (c)--
(i) in paragraph (6), by striking ``or'' at the end;
(ii) in paragraph (7), by striking the period at the end
and inserting ``; or''; and
(iii) by adding at the end the following:
``(8) to the Drug Enforcement Administration, in connection
with a report submitted thereto under section 521 of the
Controlled Substances Act.''.
(2) Technical amendment.--Paragraph (7) of section 2702(b)
of title 18, United States Code, is amended to read as
follows:
``(7) to a law enforcement agency if the contents--
``(A) were inadvertently obtained by the service provider;
and
``(B) appear to pertain to the commission of a crime;''.
SEC. __03. SEVERABILITY.
If any provision of this Act or amendment made by this Act,
or the application of such a provision or amendment to any
person or circumstance, is held to be unconstitutional, the
remaining provisions of this Act and amendments made by this
Act, and the application of such provision or amendment to
any other person or circumstance, shall not be affected
thereby.
______