S. 474 (ENR) - Revising Existing Procedures On Reporting via Technology Act

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 474 Enrolled Bill (ENR)]

        S.474

                     One Hundred Eighteenth Congress

                                 of the

                        United States of America


                          AT THE SECOND SESSION

         Begun and held at the City of Washington on Wednesday,
         the third day of January, two thousand and twenty four


                                 An Act


 
 To amend title 18, United States Code, to strengthen reporting to the 
   CyberTipline related to online sexual exploitation of children, to 
modernize liabilities for such reports, to preserve the contents of such 
               reports for 1 year, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
    This Act may be cited as the ``Revising Existing Procedures On 
Reporting via Technology Act'' or the ``REPORT Act''.
SEC. 2. LIMITED LIABILITY MODERNIZATION.
    (a) Amendments.--Section 2258B of title 18, United States Code, is 
amended--
        (1) in the section heading, by striking ``providers or domain 
    name registrars'' and inserting ``the reporting, storage, and 
    handling of certain visual depictions of apparent child pornography 
    to the National Center for Missing & Exploited Children'';
        (2) in subsection (b)--
            (A) in the matter preceding paragraph (1), by inserting 
        ``or charge'' after ``a claim''; and
            (B) in paragraph (2)(C), by striking ``this section,''; and
        (3) by adding at the end the following:
    ``(d) Limited Liability for NCMEC-Contracted Vendors.--
        ``(1) In general.--Except as provided in paragraph (2), a civil 
    claim or criminal charge may not be brought in any Federal or State 
    court against a vendor contractually retained and designated by 
    NCMEC to support the duties of NCMEC under section 404(b)(1)(K) of 
    the Juvenile Justice and Delinquency Prevention Act of 1974 (34 
    U.S.C. 11293(b)(1)(K)).
        ``(2) Intentional, reckless, or other misconduct.--Paragraph 
    (1) shall not apply to a claim or charge if the vendor--
            ``(A) engaged in--
                ``(i) intentional misconduct; or
                ``(ii) negligent conduct; or
            ``(B) acted, or failed to act--
                ``(i) with actual malice;
                ``(ii) with reckless disregard to a substantial risk of 
            causing injury without legal justification; or
                ``(iii) for a purpose unrelated to the performance of 
            any responsibility or function--

                    ``(I) set forth in paragraph (1); or
                    ``(II) pursuant to sections 2258A, 2258C, 2702, or 
                2703.

        ``(3) Vendor cybersecurity requirements.--With respect to any 
    visual depiction provided pursuant to the duties of NCMEC under 
    section 404(b)(1)(K) of the Juvenile Justice and Delinquency 
    Prevention Act of 1974 (34 U.S.C. 11293(b)(1)(K)) that is stored or 
    transferred by a vendor contractually retained and designated by 
    NCMEC to support such duties of NCMEC, a vendor shall--
            ``(A) secure such visual depiction in a manner that is 
        consistent with the most recent version of the Cybersecurity 
        Framework developed by the National Institute of Standards and 
        Technology, or any successor thereto;
            ``(B) minimize the number of employees that may be able to 
        obtain access to such visual depiction;
            ``(C) employ end-to-end encryption for data storage and 
        transfer functions, or an equivalent technological standard;
            ``(D) undergo an independent annual cybersecurity audit to 
        determine whether such visual depiction is secured as required 
        under subparagraph (A); and
            ``(E) promptly address all issues identified by an audit 
        described in subparagraph (D).
    ``(e) Limited Liability for Reporting Apparent Child Pornography by 
an Individual Depicted in the Child Pornography as a Minor, or a 
Representative of Such Individual.--
        ``(1) In general.--Except as provided in paragraph (2), a civil 
    claim or criminal charge may not be brought in any Federal or State 
    court against an individual depicted in child pornography as a 
    minor, or a representative of such individual, arising from a 
    report to the NCMEC CyberTipline by the individual, or the 
    representative of such individual, of information that relates to 
    the child pornography in which the individual is depicted as a 
    minor, including a copy of the child pornography.
        ``(2) Intentional, reckless, or other misconduct.--Paragraph 
    (1) shall not apply to a claim or charge if the individual, or the 
    representative of such individual--
            ``(A) engaged in--
                ``(i) intentional misconduct;
                ``(ii) negligent conduct; or
                ``(iii) any activity which constitutes a violation of 
            section 2251; or
            ``(B) acted, or failed to act--
                ``(i) with actual malice; or
                ``(ii) with reckless disregard to a substantial risk of 
            causing injury without legal justification.
        ``(3) Minimizing access.--With respect to any child pornography 
    reported to the NCMEC CyberTipline by an individual depicted in the 
    child pornography as a minor, or a representative of such 
    individual, NCMEC shall minimize access to the child pornography 
    and ensure the appropriate deletion of the child pornography, as 
    set forth in section 2258D.
        ``(4) Definition.--For purposes of this subsection, the term 
    `representative', with respect to an individual depicted in child 
    pornography--
            ``(A) means--
                ``(i) the parent or legal guardian of the individual, 
            if the individual is under 18 years of age;
                ``(ii) the legal guardian or other person appointed by 
            a court to represent the individual;
                ``(iii) a legal representative retained by the 
            individual;
                ``(iv) a representative of the estate of the 
            individual; or
                ``(v) a person who is a mandated reporter under section 
            226(a)(1) of the Victims of Child Abuse Act of 1990 (34 
            U.S.C. 20341(a)(1)); and
            ``(B) does not include a person who engaged in any activity 
        which constitutes a violation of section 2251.''.
    (b) Applicability.--The amendments made by subsection (a) shall 
apply with respect to a civil claim or criminal charge that is filed on 
or after the date of enactment of this Act.
    (c) Table of Sections Amendment.--The table of sections for chapter 
110 of title 18, United States Code, is amended by striking the item 
relating to section 2258B and inserting the following:
``2258B. Limited liability for the reporting, storage, and handling of 
          certain visual depictions of apparent child pornography to the 
          National Center for Missing & Exploited Children.''.
SEC. 3. PRESERVATION OF REPORTS TO CYBERTIPLINE RELATED TO ONLINE 
SEXUAL EXPLOITATION OF CHILDREN.
    Section 2258A(h) of title 18, United States Code, is amended--
        (1) in paragraph (1), by striking ``90 days'' and inserting ``1 
    year''; and
        (2) by adding at the end the following:
        ``(5) Extension of preservation.--A provider of a report to the 
    CyberTipline under subsection (a)(1) may voluntarily preserve the 
    contents provided in the report (including any comingled content 
    described in paragraph (2)) for longer than 1 year after the 
    submission to the CyberTipline for the purpose of reducing the 
    proliferation of online child sexual exploitation or preventing the 
    online sexual exploitation of children.
        ``(6) Method of preservation.--Not later than 1 year after the 
    date of enactment of this paragraph, a provider of a report to the 
    CyberTipline under subsection (a)(1) shall preserve materials under 
    this subsection in a manner that is consistent with the most recent 
    version of the Cybersecurity Framework developed by the National 
    Institute of Standards and Technology, or any successor thereto.''.
SEC. 4. STRENGTHENING OF DUTY TO REPORT APPARENT VIOLATIONS TO 
CYBERTIPLINE RELATED TO ONLINE EXPLOITATION OF CHILDREN.
    (a) Amendments.--Section 2258A of title 18, United States Code, is 
amended--
        (1) in subsection (a)(2)(A), by inserting ``, of section 1591 
    (if the violation involves a minor), or of 2422(b)'' after ``child 
    pornography''; and
        (2) in subsection (e)--
            (A) in paragraph (1), by striking ``$150,000'' and 
        inserting ``$850,000 in the case of a provider with not less 
        than 100,000,000 monthly active users or $600,000 in the case 
        of a provider with less than 100,000,000 monthly active 
        users''; and
            (B) in paragraph (2), by striking ``$300,000'' and 
        inserting ``$1,000,000 in the case of a provider with not less 
        than 100,000,000 monthly active users or $850,000 in the case 
        of a provider with less than 100,000,000 monthly active 
        users''.
    (b) Guidelines.--Not later than 180 days after the date of 
enactment of this Act, the National Center for Missing & Exploited 
Children may issue guidelines, as appropriate, to providers required or 
permitted to take actions described in section 2258A(a)(1)(B) of title 
18, United States Code, on the relevant identifiers for content that 
may indicate sex trafficking of children, as described in section 1591 
of that title, or enticement, as described in section 2422(b) of that 
title.

                               Speaker of the House of Representatives.

                            Vice President of the United States and    
                                               President of the Senate.