Law enforcement agencies could use approved cloud vendors to store evidence

Covered agencies could contract with approved cloud providers to store and process specified digital evidence. Covered agencies include Federal, State, Tribal, and local law enforcement and prosecutorial agencies. Approved vendors must meet the security rules and be contractually retained by an agency. Vendors could provide storage, access for designated agencies, maintenance, technical and analytical help, and forensic tool processing. Civil claims and criminal charges would generally be barred for services performed under the contract, but they could proceed for intentional or negligent conduct, actual malice, reckless disregard, or unrelated purposes.

Approved vendors would have to secure stored evidence and follow several oversight and data-handling rules. The rules apply to child pornography, child obscenity, and intimate digital depictions of minors that an approved vendor stores, maintains, or processes. Vendors would have to use current federal cybersecurity standards, limit employee access, keep access records, encrypt data or use an equivalent standard, and fix audit findings. Vendors could access the evidence only with the contracting agency's consent and for permitted support or forensic work. The evidence would generally have to remain in the United States. An agency could approve an overseas transfer when it considers the transfer necessary for an investigation. The vendor would have to file contract information with the Justice Department's Criminal Division. Vendors would have to file the notification letter within 30 days after entering the contract and promptly address audit problems.

Agencies would have to preserve the evidence for required periods, and vendors would have to report certain contract problems and preserve evidence during transfer. These duties apply when a covered agency stores the specified evidence under an approved-vendor contract and when the agency fails to pay, materially breaches the contract, or ends it without arranging a lawful transfer. Agencies would follow FBI security policy and applicable evidence-retention laws, court rules, or prosecutorial policies. If no such retention rule exists, the agency would keep the evidence for at least the statute of limitations or the sentence, including post-conviction review. After reporting a contract problem, the vendor would preserve the evidence until a prompt and lawful transfer to an agency with jurisdiction. A vendor would have to report the payment failure, material breach, or improper termination within 30 days and preserve the evidence until custody transfers lawfully.