What changed between these versions
A substantive expansion of the bill's scope. v3 broadens the types of material covered to include "intimate visual depictions of minors" in addition to child pornography and child obscenity, impacting liability protections and cybersecurity requirements for approved vendors. New definitions and a rule of construction were also added, alongside several clarifications to notification and audit requirements.
Overview
A handful of significant changes, primarily focused on expanding the scope of material covered and clarifying operational procedures. · v3 expands the scope of the material covered by the bill and clarifies several procedural and definitional aspects, while maintaining the core policy direction of limiting liability for approved vendors.
The most significant change in v3 is the expansion of the types of digital material covered by the bill to include "intimate visual depictions of minors," alongside child pornography and child obscenity. This change is reflected throughout the bill, affecting definitions, liability protections, and cybersecurity requirements for approved vendors. Additionally, v3 introduces new explicit definitions for "cloud service provider," "covered agency," "local," and "State," and adds a new rule of construction to clarify the bill's limitations. Minor modifications were also made to cybersecurity audit specifics and Department of Justice notification details.
Major additions
This new definition clarifies the term "cloud service provider" as an organization, corporation, or entity that offers digital storage services, including remote or cloud-based storage, and analytical and forensic tool processing support.
The explicit definition of "cloud service provider" provides greater clarity on the types of entities eligible to be "approved vendors," ensuring that the scope of the bill's protections and requirements is well-understood by potential service providers. This helps to precisely delineate the industry segment targeted by the legislation.
This new definition establishes "covered agency" as a Federal, State, or local law enforcement or prosecutorial agency. This term is then used consistently throughout the rest of the bill.
By defining "covered agency," the bill streamlines its language and clearly identifies the governmental entities that can contract with approved vendors under the act. This ensures consistent application of the bill's provisions to all relevant law enforcement and prosecutorial bodies, regardless of their jurisdictional level.
This new definition introduces "intimate visual depiction of a minor" as an intimate visual depiction (as defined in 47 U.S.C. 223(h)), including a digital forgery, of an identifiable individual who is a minor.
This is a significant expansion of the bill's scope, extending the limited liability protections and cybersecurity requirements to a broader category of illicit material beyond just child pornography and child obscenity. This change provides legal clarity and operational framework for law enforcement agencies and approved vendors when handling this specific type of sensitive content, which was not explicitly covered in v2.
These new definitions explicitly define "local" as any political subdivision of a State and "State" to include the 50 States, District of Columbia, Puerto Rico, Virgin Islands, Guam, American Samoa, and Northern Mariana Islands.
These definitions provide clear and comprehensive jurisdictional boundaries for the application of the bill, ensuring that all relevant governmental entities and territories are explicitly included. This reduces ambiguity regarding which agencies and locations fall under the purview of the act.
This new subparagraph creates an exception to the general rule that stored material must remain in the United States. It allows child pornography, child obscenity, and intimate visual depictions of a minor to be transferred outside the United States with the express consent of the contracting covered agency if deemed necessary for investigative purposes.
This exception provides critical flexibility for law enforcement agencies, allowing them to transfer sensitive digital evidence internationally when an investigation requires it. This acknowledges the transnational nature of child exploitation crimes and ensures that the data location requirement does not impede cross-border law enforcement efforts, while still requiring agency consent.
This new subsection provides a rule of construction, clarifying that nothing in the section limits the bona fide use of stored material by the contracting covered agency (including providing it for investigation or prosecution) or the agency's obligation to comply with constitutional/statutory obligations, court orders, or victim requests.
This addition is crucial for ensuring that the bill's provisions, particularly those related to limited liability and vendor requirements, do not inadvertently restrict law enforcement's ability to use evidence or fulfill their legal and ethical obligations. It explicitly protects the operational integrity of investigations and the rights of victims, providing legal certainty for agencies.
Modifications
This modification broadens the types of digital content for which vendors can receive limited liability and must adhere to security protocols, now encompassing 'intimate visual depictions of minors.' It also clarifies the nature of the vendor and the contracting agency by using the new, more precise definitions, affecting cloud service providers and law enforcement agencies by expanding the scope of their protected activities.
Before
In v2, an 'approved vendor' was defined as an organization, corporation, or entity offering digital storage and analytical support, contractually retained by a U.S.-based law enforcement or prosecutorial agency to store child pornography or child obscenity, make it available, and provide support.
After
In v3, an 'approved vendor' is now defined as a 'cloud service provider' that complies with security requirements and is contractually retained by a 'covered agency' to store digital child pornography, child obscenity, or an 'intimate visual depiction of a minor,' make it available, and provide support.
This change provides a more precise statutory reference for the definition of child pornography, ensuring legal accuracy and reducing any potential ambiguity in interpretation for law enforcement agencies and approved vendors regarding the specific legal definition being referenced.
Before
In v2, 'child pornography' was defined as having the meaning given in section 2256 of title 18, United States Code.
After
In v3, 'child pornography' is defined as having the meaning given in section 2256(8) of title 18, United States Code.
This modification imposes a new administrative and security requirement on approved vendors, enhancing accountability and auditability regarding access to sensitive material. This directly affects vendors by requiring more stringent internal controls and record-keeping, providing greater transparency for covered agencies regarding data access.
Before
In v2, approved vendors were required to minimize the number of employees that may be able to obtain access to visual depictions.
After
In v3, approved vendors are required to minimize the number of employees that may be able to obtain access to such material and 'maintain a list of employees who have obtained such access'.
This modification significantly strengthens the cybersecurity audit requirements for approved vendors. By specifying NIST SP 800-53, Revision 5, the bill sets a higher, more detailed standard for security and privacy controls, directly impacting vendors by requiring more rigorous compliance and auditing processes. This provides greater assurance of data security for covered agencies.
Before
In v2, approved vendors were required to undergo an independent annual cybersecurity audit to determine whether visual depictions were secured as required under paragraph (1).
After
In v3, approved vendors are required to undergo an independent annual cybersecurity audit to determine whether such material is secured as required by paragraphs (1), (3), and (4), 'including by assessing compliance with the National Institute of Standards and Technology Special Publication 800-53, Revision 5 (relating to security and privacy controls for information systems and organizations) or any successor documents or revisions'.
This clarification ensures that covered agencies can comply with security policies from the most relevant or updated FBI division, providing flexibility while maintaining high security standards. This affects covered agencies by broadening the specific FBI entity whose security policies they may need to follow, accommodating potential organizational changes within the FBI.
Before
In v2, law enforcement or prosecutorial agencies storing evidence were required to comply with the security policy of the Criminal Justice Information Services of the Federal Bureau of Investigation.
After
In v3, covered agencies storing evidence are required to comply with the security policy of the Criminal Justice Information Services Division of the Federal Bureau of Investigation, 'or any other similar and appropriate division within the Federal Bureau of Investigation'.
This modification extends the domestic data residency requirement to the newly included category of 'intimate visual depictions of minors,' ensuring that all sensitive materials covered by the act are subject to the same geographic storage restrictions. This affects approved vendors by expanding the scope of material they must keep within the U.S. borders.
Before
In v2, approved vendors were required to ensure that cloud-based storage and analytics of child pornography and child obscenity remained in the United States.
After
In v3, approved vendors are required to ensure that any child pornography, child obscenity, 'or intimate visual depiction of a minor' stored pursuant to this section remains in the United States.
This modification provides a more precise point of contact within the Department of Justice for approved vendors to submit their notification letters, streamlining administrative processes. This affects approved vendors by giving them a clearer directive on where to send required communications.
Before
In v2, approved vendors were required to file a notification letter with the Department of Justice.
After
In v3, approved vendors are required to file a notification letter with the 'Criminal Division of the Department of Justice'.
This modification further refines the communication protocol for approved vendors, directing ongoing updates to a specialized section within the DOJ. This affects vendors by requiring them to direct specific updates to the most relevant departmental unit, ensuring that critical information reaches the appropriate authorities efficiently.
Before
In v2, the notification letter included the entity name, contact, contracting agency name, period, and an acknowledgment to notify the Department of Justice of changes.
After
In v3, the letter includes the same information, but the acknowledgment specifies notifying the 'Child Exploitation and Obscenity Section of the Criminal Division of the Department of Justice' of any changes.
This modification provides a clearer and more targeted notification pathway for approved vendors in the event of a contract breach by a Federal agency. This affects vendors by giving them a precise point of contact for critical breach notifications, ensuring that the appropriate Federal authorities are promptly informed.
Before
In v2, if a law enforcement or prosecutorial agency breached a contract, the approved vendor was to notify the Department of Justice (Federal) or appropriate State attorney general (State/local).
After
In v3, the notification for a breach by a Federal agency is specified to go to the 'Criminal Division of the Department of Justice', while State/local agency breaches still go to the appropriate State attorney general.
This modification clarifies the designated recipient within the Department of Justice for the lawful transfer of evidence following a contract breach. This affects approved vendors by providing a precise target for evidence transfer, ensuring continuity of evidence chain of custody and proper handling of sensitive materials.
Before
In v2, upon breach notification, the approved vendor was to maintain evidence until lawful transfer of custody to the Department of Justice or another agency.
After
In v3, the approved vendor is to maintain evidence until lawful transfer of custody occurs to the 'Criminal Division of the Department of Justice' or another agency.
This is a conforming change that ensures the table of contents accurately reflects the expanded scope of the bill, now including 'intimate visual depictions of minors'. This affects readers of the Act by providing an accurate summary of the section's content.
Before
In v2, the clerical amendment updated the table of contents for the PROTECT Our Children Act of 2008 to include "Sec. 202. Modernizing law enforcement's ability to store child pornography and child obscenity and limited liability for approved vendors."
After
In v3, the clerical amendment updates the table of contents to include "Sec. 202. Modernizing law enforcement's ability to store child pornography, child obscenity, and intimate visual depictions of minors and limited liability for approved vendors."
Scope
Meaningful expansion or narrowing — Changes are scattered throughout the new Section 202, primarily within the definitions, cybersecurity requirements, and additional vendor requirements subsections. — v3 represents a meaningful expansion of the policy direction by broadening the types of illicit material covered, while maintaining the core objective of providing limited liability for approved vendors. — The changes, particularly the expansion of material covered, interact extensively with all operative provisions of the new Section 202, as the new term 'intimate visual depiction of a minor' is integrated into liability, security, and data handling requirements.
Impact analysis
Approved vendors (cloud service providers)
Procedural change and expansion of scope, increasing their responsibilities and the types of data they can handle under the bill's protections.
Their limited liability protections and cybersecurity compliance obligations are expanded to cover 'intimate visual depictions of minors' in addition to child pornography and child obscenity. They also face new requirements to maintain a list of employees with access and adhere to a specific NIST cybersecurity publication for audits.
Federal, State, and local law enforcement and prosecutorial agencies (covered agencies)
Gain in operational flexibility and clarity regarding evidence handling, with a procedural change in how they interact with vendors for international data transfers.
They now have a legal framework and limited liability protections for approved vendors storing 'intimate visual depictions of minors,' which was not explicitly covered before. They also gain flexibility to transfer data outside the U.S. for investigative purposes with consent.
Victims of 'intimate visual depictions of minors'
Procedural change, potentially leading to more secure and effective handling of evidence related to their exploitation.
The bill's provisions now explicitly cover evidence related to 'intimate visual depictions of minors,' potentially improving the secure storage and handling of such evidence by law enforcement and their approved vendors.