S. 3023, Safe Cloud Storage Act

S. 3023 would limit civil and criminal liability for companies that contract with federal, state, and local law enforcement agencies to store digital child pornography or images of children engaging in sexually explicit conduct for the purpose of supporting investigations of child sexual exploitation. The act would establish requirements governing the storage and access of such material, including undergoing annual cybersecurity audits and retaining evidence in accordance with standards issued by the Federal Bureau of Investigation. S. 3023 would require each company to notify the Department of Justice (DOJ) within 30 days of entering a qualifying contract and in the event of a breach of such contract.

By shielding companies from some civil and criminal liability, CBO expects that enacting S. 3023 would reduce the collection of civil and criminal penalties by a small amount. Civil penalties are recorded as revenues and deposited in the Treasury. Criminal penalties are recorded as revenues, deposited in the Crime Victims Fund, and later spent without further appropriation. In total, CBO estimates that enacting S. 3023 would reduce revenues and subsequent direct spending by less than $500,000 over the 2026-2036 period.

Based on the costs of similar activities, CBO estimates that DOJ would incur administrative and personnel costs of less than $500,000 over the 2026-2031 period to update its policies and regulations. Any related spending would be subject to the availability of appropriated funds.

Current law provides a liability shield to digital storage companies that contract directly with the National Center for Missing and Exploited Children (NCMEC) to receive and store digital evidence of child sex exploitation and abuse. S. 3023 would expand those liability protections to companies that contract with federal, state, and local law enforcement agencies for the same purposes. The act would impose intergovernmental and private-sector mandates as defined in the Unfunded Mandates Reform Act (UMRA) by removing a right of action from public and private entities to pursue legal action against digital storage companies for storing this material.

However, based on information from child protection groups, CBO expects that few, if any, companies currently provide such storage services to law enforcement because of the legal risks of doing so. Therefore, CBO estimates that the cost of the mandate would be small and below the intergovernmental and private-sector thresholds established in UMRA ($107 million and $214 million respectfully, in 2026, adjusted annually for inflation).

S. 3023 also would impose an intergovernmental mandate on state and local law enforcement agencies by requiring them to include certain provisions in future contracts with companies providing digital storage of child sexual abuse material. CBO estimates that the cost of these administrative duties would be small and under the intergovernmental threshold.

The CBO staff contacts for this estimate are Jeremy Crimm (for federal costs) and Erich Dvorak (for mandates). The estimate was reviewed by H. Samuel Papenfuss, Deputy Director of Budget Analysis.