[118th Congress Public Law 59]
[From the U.S. Government Publishing Office]
[[Page 1013]]
REVISING EXISTING PROCEDURES
ON REPORTING VIA TECHNOLOGY ACT
[[Page 138 STAT. 1014]]
Public Law 118-59
118th Congress
An Act
To amend title 18, United States Code, to strengthen reporting to the
CyberTipline related to online sexual exploitation of children, to
modernize liabilities for such reports, to preserve the contents of such
reports for 1 year, and for other purposes. <<NOTE: May 7, 2024 - [S.
474]>>
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled, <<NOTE: Revising
Existing Procedures On Reporting via Technology Act.>>
SECTION <<NOTE: 18 USC 1 note.>> 1. SHORT TITLE.
This Act may be cited as the ``Revising Existing Procedures On
Reporting via Technology Act'' or the ``REPORT Act''.
SEC. 2. LIMITED LIABILITY MODERNIZATION.
(a) Amendments.--Section 2258B of title 18, United States Code, is
amended--
(1) in the section heading, by striking ``providers or
domain name registrars'' and inserting ``the reporting, storage,
and handling of certain visual depictions of apparent child
pornography to the National Center for Missing & Exploited
Children'';
(2) in subsection (b)--
(A) in the matter preceding paragraph (1), by
inserting ``or charge'' after ``a claim''; and
(B) in paragraph (2)(C), by striking ``this
section,''; and
(3) by adding at the end the following:
``(d) Limited Liability for NCMEC-Contracted Vendors.--
``(1) In general.--Except as provided in paragraph (2), a
civil claim or criminal charge may not be brought in any Federal
or State court against a vendor contractually retained and
designated by NCMEC to support the duties of NCMEC under section
404(b)(1)(K) of the Juvenile Justice and Delinquency Prevention
Act of 1974 (34 U.S.C. 11293(b)(1)(K)).
``(2) Intentional, reckless, or other misconduct.--Paragraph
(1) shall not apply to a claim or charge if the vendor--
``(A) engaged in--
``(i) intentional misconduct; or
``(ii) negligent conduct; or
``(B) acted, or failed to act--
``(i) with actual malice;
``(ii) with reckless disregard to a
substantial risk of causing injury without legal
justification; or
``(iii) for a purpose unrelated to the
performance of any responsibility or function--
``(I) set forth in paragraph (1); or
[[Page 138 STAT. 1015]]
``(II) pursuant to sections 2258A,
2258C, 2702, or 2703.
``(3) Vendor cybersecurity requirements.--With respect to
any visual depiction provided pursuant to the duties of NCMEC
under section 404(b)(1)(K) of the Juvenile Justice and
Delinquency Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K))
that is stored or transferred by a vendor contractually retained
and designated by NCMEC to support such duties of NCMEC, a
vendor shall--
``(A) secure such visual depiction in a manner that
is consistent with the most recent version of the
Cybersecurity Framework developed by the National
Institute of Standards and Technology, or any successor
thereto;
``(B) minimize the number of employees that may be
able to obtain access to such visual depiction;
``(C) employ end-to-end encryption for data storage
and transfer functions, or an equivalent technological
standard;
``(D) undergo an independent annual cybersecurity
audit to determine whether such visual depiction is
secured as required under subparagraph (A); and
``(E) promptly address all issues identified by an
audit described in subparagraph (D).
``(e) Limited Liability for Reporting Apparent Child Pornography by
an Individual Depicted in the Child Pornography as a Minor, or a
Representative of Such Individual.--
``(1) In general.--Except as provided in paragraph (2), a
civil claim or criminal charge may not be brought in any Federal
or State court against an individual depicted in child
pornography as a minor, or a representative of such individual,
arising from a report to the NCMEC CyberTipline by the
individual, or the representative of such individual, of
information that relates to the child pornography in which the
individual is depicted as a minor, including a copy of the child
pornography.
``(2) Intentional, reckless, or other misconduct.--Paragraph
(1) shall not apply to a claim or charge if the individual, or
the representative of such individual--
``(A) engaged in--
``(i) intentional misconduct;
``(ii) negligent conduct; or
``(iii) any activity which constitutes a
violation of section 2251; or
``(B) acted, or failed to act--
``(i) with actual malice; or
``(ii) with reckless disregard to a
substantial risk of causing injury without legal
justification.
``(3) Minimizing access.--With respect to any child
pornography reported to the NCMEC CyberTipline by an individual
depicted in the child pornography as a minor, or a
representative of such individual, NCMEC shall minimize access
to the child pornography and ensure the appropriate deletion of
the child pornography, as set forth in section 2258D.
``(4) Definition.--For purposes of this subsection, the term
`representative', with respect to an individual depicted in
child pornography--
``(A) means--
[[Page 138 STAT. 1016]]
``(i) the parent or legal guardian of the
individual, if the individual is under 18 years of
age;
``(ii) the legal guardian or other person
appointed by a court to represent the individual;
``(iii) a legal representative retained by the
individual;
``(iv) a representative of the estate of the
individual; or
``(v) a person who is a mandated reporter
under section 226(a)(1) of the Victims of Child
Abuse Act of 1990 (34 U.S.C. 20341(a)(1)); and
``(B) does not include a person who engaged in any
activity which constitutes a violation of section
2251.''.
(b) <<NOTE: 18 USC 2258B note.>> Applicability.--The amendments
made by subsection (a) shall apply with respect to a civil claim or
criminal charge that is filed on or after the date of enactment of this
Act.
(c) Table of Sections Amendment.--The table of sections for chapter
110 of title 18, United States Code, <<NOTE: 18 USC prec. 2251.>> is
amended by striking the item relating to section 2258B and inserting the
following:
``2258B. Limited liability for the reporting, storage, and handling of
certain visual depictions of apparent child pornography to
the National Center for Missing & Exploited Children.''.
SEC. 3. PRESERVATION OF REPORTS TO CYBERTIPLINE RELATED TO ONLINE
SEXUAL EXPLOITATION OF CHILDREN.
Section 2258A(h) of title 18, United States Code, is amended--
(1) in paragraph (1), by striking ``90 days'' and inserting
``1 year''; and
(2) by adding at the end the following:
``(5) <<NOTE: Time period.>> Extension of preservation.--A
provider of a report to the CyberTipline under subsection (a)(1)
may voluntarily preserve the contents provided in the report
(including any comingled content described in paragraph (2)) for
longer than 1 year after the submission to the CyberTipline for
the purpose of reducing the proliferation of online child sexual
exploitation or preventing the online sexual exploitation of
children.
``(6) Method of preservation. <<NOTE: Deadline.>> --Not
later than 1 year after the date of enactment of this paragraph,
a provider of a report to the CyberTipline under subsection
(a)(1) shall preserve materials under this subsection in a
manner that is consistent with the most recent version of the
Cybersecurity Framework developed by the National Institute of
Standards and Technology, or any successor thereto.''.
SEC. 4. STRENGTHENING OF DUTY TO REPORT APPARENT VIOLATIONS TO
CYBERTIPLINE RELATED TO ONLINE EXPLOITATION OF
CHILDREN.
(a) Amendments.--Section 2258A of title 18, United States Code, is
amended--
(1) in subsection (a)(2)(A), by inserting ``, of section
1591 (if the violation involves a minor), or of 2422(b)'' after
``child pornography''; and
(2) in subsection (e)--
(A) in paragraph (1), by striking ``$150,000'' and
inserting ``$850,000 in the case of a provider with not
less than 100,000,000 monthly active users or $600,000
[[Page 138 STAT. 1017]]
in the case of a provider with less than 100,000,000
monthly active users''; and
(B) in paragraph (2), by striking ``$300,000'' and
inserting ``$1,000,000 in the case of a provider with
not less than 100,000,000 monthly active users or
$850,000 in the case of a provider with less than
100,000,000 monthly active users''.
(b) <<NOTE: Deadline. 18 USC 2258A note.>> Guidelines.--Not later
than 180 days after the date of enactment of this Act, the National
Center for Missing & Exploited Children may issue guidelines, as
appropriate, to providers required or permitted to take actions
described in section 2258A(a)(1)(B) of title 18, United States Code, on
the relevant identifiers for content that may indicate sex trafficking
of children, as described in section 1591 of that title, or enticement,
as described in section 2422(b) of that title.
Approved May 7, 2024.
LEGISLATIVE HISTORY--S. 474:
---------------------------------------------------------------------------
CONGRESSIONAL RECORD:
Vol. 169 (2023):
Dec. 14, considered and passed
Senate.
Vol. 170 (2024):
Apr. 29, considered and passed
House.
<all>