§ 2258B. Limited liability for the reporting, storage, and handling of certain visual depictions of apparent child pornography to the National Center for Missing & Exploited Children

Footnotes

1. 1 So in original. Probably should be “section”.

Legislative history

Reconstructed from this section’s Code source credit and amendment notes, resolved against the local Statutes at Large. Editorial notes are evidence, not the law that made the change.

1. 2008

   Providing Resources, Officers, and Technology To Eradicate Cyber Threats to Our Children Act of 2008

   Pub. L. 110–401 title V § 501(a) · 122 Stat. 4229

   Enacted · 18 U.S.C. § 2258B

   Added Pub. L. 110–401, title V, § 501(a), Oct. 13, 2008, 122 Stat. 4248

   Source evidence

   Code source credit
   Added Pub. L. 110–401, title V, § 501(a), Oct. 13, 2008, 122 Stat. 4248

   Enacted provision · exact public law section
   (a) In General.— Chapter 110 of title 18, United States Code, is amended by inserting after section 2258 the following: “SEC. 2258A. REPORTING REQUIREMENTS OF ELECTRONIC COMMUNICATION SERVICE PROVIDERS AND REMOTE COMPUTING SERVICE PROVIDERS. “(a) Duty To Report.— “(1) In general.— Whoever, while engaged in providing an electronic communication service or a remote computing service to the public through a facility or means of interstate or foreign commerce, obtains actual knowledge of any facts or circumstances described in paragraph (2) shall, as soon as reasonably possible— “(A) provide to the CyberTipline of the National Center for Missing and Exploited Children, or any successor to the CyberTipline operated by such center, the mailing address, telephone number, facsimile number, electronic mail address of, and individual point of contact for, such electronic communication service provider or remote computing service provider; and “(B) make a report of such facts or circumstances to the CyberTipline, or any successor to the CyberTipline operated by such center. “(2) Facts or circumstances.— The facts or circumstances described in this paragraph are any facts or circumstances from which there is an apparent violation of— “(A) section 2251, 2251A, 2252, 2252A, 2252B, or 2260 that involves child pornography; or “(B) section 1466A. “(b) Contents of Report.— To the extent the information is within the custody or control of an electronic communication service provider or a remote computing service provider, the facts and circumstances included in each report under subsection (a)(1) may include the following information: “(1) Information about the involved individual.— Information relating to the identity of any individual who appears to have violated a Federal law described in subsection (a)(2), which may, to the extent reasonably practicable, include the electronic mail address, Internet Protocol address, uniform resource locator, or any other identifying information, including self-reported identifying information. “(2) Historical reference.— Information relating to when and how a customer or subscriber of an electronic communication service or a remote computing service uploaded, transmitted, or received apparent child pornography or when and how apparent child pornography was reported to, or discovered by the electronic communication service provider or remote computing service provider, including a date and time stamp and time zone. “(3) Geographic location information.— “(A) In general.— Information relating to the geographic location of the involved individual or website, which may include the Internet Protocol address or verified billing address, or, if not reasonably available, at least 1 form of geographic identifying information, including area code or zip code. “(B) Inclusion.— The information described in subparagraph (A) may also include any geographic information provided to the electronic communication service or remote computing service by the customer or subscriber. “(4) Images of apparent child pornography.— Any image of apparent child pornography relating to the incident such report is regarding. “(5) Complete communication.— The complete communication containing any image of apparent child pornography, including— “(A) any data or information regarding the transmission of the communication; and “(B) any images, data, or other digital files contained in, or attached to, the communication. “(c) Forwarding of Report to Law Enforcement.— “(1) In general.— The National Center for Missing and Exploited Children shall forward each report made under subsection (a)(1) to any appropriate law enforcement agency designated by the Attorney General under subsection (d)(2). “(2) State and local law enforcement.— The National Center for Missing and Exploited Children may forward any report made under subsection (a)(1) to an appropriate law enforcement official of a State or political subdivision of a State for the purpose of enforcing State criminal law. “(3) Foreign law enforcement.— “(A) In general.— The National Center for Missing and Exploited Children may forward any report made under subsection (a)(1) to any appropriate foreign law enforcement agency designated by the Attorney General under subsection (d)(3), subject to the conditions established by the Attorney General under subsection (d)(3). “(B) Transmittal to designated federal agencies.— If the National Center for Missing and Exploited Children forwards a report to a foreign law enforcement agency under subparagraph (A), the National Center for Missing and Exploited Children shall concurrently provide a copy of the report and the identity of the foreign law enforcement agency to— “(i) the Attorney General; or “(ii) the Federal law enforcement agency or agencies designated by the Attorney General under subsection (d)(2). “(d) Attorney General Responsibilities.— “(1) In general.— The Attorney General shall enforce this section. “(2) Designation of federal agencies.— The Attorney General shall designate promptly the Federal law enforcement agency or agencies to which a report shall be forwarded under subsection (c)(1). “(3) Designation of foreign agencies.— The Attorney General shall promptly— “(A) in consultation with the Secretary of State, designate the foreign law enforcement agencies to which a report may be forwarded under subsection (c)(3); “(B) establish the conditions under which such a report may be forwarded to such agencies; and “(C) develop a process for foreign law enforcement agencies to request assistance from Federal law enforcement agencies in obtaining evidence related to a report referred under subsection (c)(3). “(4) Reporting designated foreign agencies.— The Attorney General shall maintain and make available to the Department of State, the National Center for Missing and Exploited Children, electronic communication service providers, remote computing service providers, the Committee on the Judiciary of the Senate, and the Committee on the Judiciary of the House of Representatives a list of the foreign law enforcement agencies designated under paragraph (3). “(5) Sense of congress regarding designation of foreign agencies.— It is the sense of Congress that— “(A) combating the international manufacturing, possession, and trade in online child pornography requires cooperation with competent, qualified, and appropriately trained foreign law enforcement agencies; and “(B) the Attorney General, in cooperation with the Secretary of State, should make a substantial effort to expand the list of foreign agencies designated under paragraph (3). “(6) Notification to providers.— If an electronic communication service provider or remote computing service provider notifies the National Center for Missing and Exploited Children that the electronic communication service provider or remote computing service provider is making a report under this section as the result of a request by a foreign law enforcement agency, the National Center for Missing and Exploited Children shall— “(A) if the Center forwards the report to the requesting foreign law enforcement agency or another agency in the same country designated by the Attorney General under paragraph (3), notify the electronic communication service provider or remote computing service provider of— “(i) the identity of the foreign law enforcement agency to which the report was forwarded; and “(ii) the date on which the report was forwarded; or “(B) notify the electronic communication service provider or remote computing service provider if the Center declines to forward the report because the Center, in consultation with the Attorney General, determines that no law enforcement agency in the foreign country has been designated by the Attorney General under paragraph (3). “(e) Failure To Report.— An electronic communication service provider or remote computing service provider that knowingly and willfully fails to make a report required under subsection (a)(1) shall be fined— “(1) in the case of an initial knowing and willful failure to make a report, not more than $150,000; and “(2) in the case of any second or subsequent knowing and willful failure to make a report, not more than $300,000. “(f) Protection of Privacy.— Nothing in this section shall be construed to require an electronic communication service provider or a remote computing service provider to— “(1) monitor any user, subscriber, or customer of that provider; “(2) monitor the content of any communication of any person described in paragraph (1); or “(3) affirmatively seek facts or circumstances described in sections (a) and (b). “(g) Conditions of Disclosure Information Contained Within Report.— “(1) In general.— Except as provided in paragraph (2), a law enforcement agency that receives a report under subsection (c) shall not disclose any information contained in that report. “(2) Permitted disclosures by law enforcement.— “(A) In general.— A law enforcement agency may disclose information in a report received under subsection (c)— “(i) to an attorney for the government for use in the performance of the official duties of that attorney; “(ii) to such officers and employees of that law enforcement agency, as may be necessary in the performance of their investigative and recordkeeping functions; “(iii) to such other government personnel (including personnel of a State or subdivision of a State) as are determined to be necessary by an attorney for the government to assist the attorney in the performance of the official duties of the attorney in enforcing Federal criminal law; “(iv) if the report discloses a violation of State criminal law, to an appropriate official of a State or subdivision of a State for the purpose of enforcing such State law; “(v) to a defendant in a criminal case or the attorney for that defendant, subject to the terms and limitations under section 3509(m) or a similar State law, to the extent the information relates to a criminal charge pending against that defendant; “(vi) subject to subparagraph (B), to an electronic communication service provider or remote computing provider if necessary to facilitate response to legal process issued in connection to a criminal investigation, prosecution, or post-conviction remedy relating to that report; and “(vii) as ordered by a court upon a showing of good cause and pursuant to any protective orders or other conditions that the court may impose. “(B) Limitations.— “(i) Limitations on further disclosure.— The electronic communication service provider or remote computing service provider shall be prohibited from disclosing the contents of a report provided under subparagraph (A)(vi) to any person, except as necessary to respond to the legal process. “(ii) Effect.— Nothing in subparagraph (A)(vi) authorizes a law enforcement agency to provide child pornography images to an electronic communications service provider or a remote computing service. “(3) Permitted disclosures by the national center for missing and exploited children.— The National Center for Missing and Exploited Children may disclose information received in a report under subsection (a) only— “(A) to any Federal law enforcement agency designated by the Attorney General under subsection (d)(2); “(B) to any State, local, or tribal law enforcement agency involved in the investigation of child pornography, child exploitation, kidnapping, or enticement crimes; “(C) to any foreign law enforcement agency designated by the Attorney General under subsection (d)(3); and “(D) to an electronic communication service provider or remote computing service provider as described in section 2258C. “(h) Preservation.— “(1) In general.— For the purposes of this section, the notification to an electronic communication service provider or a remote computing service provider by the CyberTipline of receipt of a report under subsection (a)(1) shall be treated as a request to preserve, as if such request was made pursuant to section 2703(f). “(2) Preservation of report.— Pursuant to paragraph (1), an electronic communication service provider or a remote computing service shall preserve the contents of the report provided pursuant to subsection (b) for 90 days after such notification by the CyberTipline. “(3) Preservation of commingled images.— Pursuant to paragraph (1), an electronic communication service provider or a remote computing service shall preserve any images, data, or other digital files that are commingled or interspersed among the images of apparent child pornography within a particular communication or user-created folder or directory. “(4) Protection of preserved materials.— An electronic communications service or remote computing service preserving materials under this section shall maintain the materials in a secure location and take appropriate steps to limit access by agents or employees of the service to the materials to that access necessary to comply with the requirements of this subsection. “(5) Authorities and duties not affected.— Nothing in this section shall be construed as replacing, amending, or otherwise interfering with the authorities and duties under section 2703. “SEC. 2258B. LIMITED LIABILITY FOR ELECTRONIC COMMUNICATION SERVICE PROVIDERS, REMOTE COMPUTING SERVICE PROVIDERS, OR DOMAIN NAME REGISTRAR. “(a) In General.— Except as provided in subsection (b), a civil claim or criminal charge against an electronic communication service provider, a remote computing service provider, or domain name registrar, including any director, officer, employee, or agent of such electronic communication service provider, remote computing service provider, or domain name registrar arising from the performance of the reporting or preservation responsibilities of such electronic communication service provider, remote computing service provider, or domain name registrar under this section, section 2258A, or section 2258C may not be brought in any Federal or State court. “(b) Intentional, Reckless, or Other Misconduct.— Subsection (a) shall not apply to a claim if the electronic communication service provider, remote computing service provider, or domain name registrar, or a director, officer, employee, or agent of that electronic communication service provider, remote computing service provider, or domain name registrar— “(1) engaged in intentional misconduct; or “(2) acted, or failed to act— “(A) with actual malice; “(B) with reckless disregard to a substantial risk of causing physical injury without legal justification; or “(C) for a purpose unrelated to the performance of any responsibility or function under this section, sections 2258A, 2258C, 2702, or 2703. “(c) Minimizing Access.— An electronic communication service provider, a remote computing service provider, and domain name registrar shall— “(1) minimize the number of employees that are provided access to any image provided under section 2258A or 2258C; and “(2) ensure that any such image is permanently destroyed, upon a request from a law enforcement agency to destroy the image. “SEC. 2258C. USE TO COMBAT CHILD PORNOGRAPHY OF TECHNICAL ELEMENTS RELATING TO IMAGES REPORTED TO THE CYBERTIPLINE. “(a) Elements.— “(1) In general.— The National Center for Missing and Exploited Children may provide elements relating to any apparent child pornography image of an identified child to an electronic communication service provider or a remote computing service provider for the sole and exclusive purpose of permitting that electronic communication service provider or remote computing service provider to stop the further transmission of images. “(2) Inclusions.— The elements authorized under paragraph (1) may include hash values or other unique identifiers associated with a specific image, Internet location of images, and other technological elements that can be used to identify and stop the transmission of child pornography. “(3) Exclusion.— The elements authorized under paragraph (1) may not include the actual images. “(b) Use by Electronic Communication Service Providers and Remote Computing Service Providers.— Any electronic communication service provider or remote computing service provider that receives elements relating to any apparent child pornography image of an identified child from the National Center for Missing and Exploited Children under this section may use such information only for the purposes described in this section, provided that such use shall not relieve that electronic communication service provider or remote computing service provider from its reporting obligations under section 2258A. “(c) Limitations.— Nothing in subsections (a) or (b) requires electronic communication service providers or remote computing service providers receiving elements relating to any apparent child pornography image of an identified child from the National Center for Missing and Exploited Children to use the elements to stop the further transmission of the images. “(d) Provision of Elements to Law Enforcement.— The National Center for Missing and Exploited Children shall make available to Federal, State, and local law enforcement involved in the investigation of child pornography crimes elements, including hash values, relating to any apparent child pornography image of an identified child reported to the National Center for Missing and Exploited Children. “(e) Use by Law Enforcement.— Any Federal, State, or local law enforcement agency that receives elements relating to any apparent child pornography image of an identified child from the National Center for Missing and Exploited Children under section (d) may use such elements only in the performance of the official duties of that agency to investigate child pornography crimes. “SEC. 2258D. LIMITED LIABILITY FOR THE NATIONAL CENTER FOR MISSING AND EXPLOITED CHILDREN. “(a) In General.— Except as provided in subsections (b) and (c), a civil claim or criminal charge against the National Center for Missing and Exploited Children, including any director, officer, employee, or agent of such center, arising from the performance of the CyberTipline responsibilities or functions of such center, as described in this section, section 2258A or 2258C of this title, or section 404 of the Missing Children’s Assistance Act (42 U.S.C. 5773), or from the effort of such center to identify child victims may not be brought in any Federal or State court. “(b) Intentional, Reckless, or Other Misconduct.— Subsection (a) shall not apply to a claim or charge if the National Center for Missing and Exploited Children, or a director, officer, employee, or agent of such center— “(1) engaged in intentional misconduct; or “(2) acted, or failed to act— “(A) with actual malice; “(B) with reckless disregard to a substantial risk of causing injury without legal justification; or “(C) for a purpose unrelated to the performance of any responsibility or function under this section, section 2258A or 2258C of this title, or section 404 of the Missing Children’s Assistance Act (42 U.S.C. 5773). “(c) Ordinary Business Activities.— Subsection (a) shall not apply to an act or omission relating to an ordinary business activity, including general administration or operations, the use of motor vehicles, or personnel management. “(d) Minimizing Access.— The National Center for Missing and Exploited Children shall— “(1) minimize the number of employees that are provided access to any image provided under section 2258A; and “(2) ensure that any such image is permanently destroyed upon notification from a law enforcement agency. “SEC. 2258E. DEFINITIONS.   “In sections 2258A through 2258D— “(1) the terms ‘attorney for the government’ and ‘State’ have the meanings given those terms in rule 1 of the Federal Rules of Criminal Procedure; “(2) the term ‘electronic communication service’ has the meaning given that term in section 2510; “(3) the term ‘electronic mail address’ has the meaning given that term in section 3 of the CAN–SPAM Act of 2003 (15 U.S.C. 7702); “(4) the term ‘Internet’ has the meaning given that term in section 1101 of the Internet Tax Freedom Act (47 U.S.C. 151 note); “(5) the term ‘remote computing service’ has the meaning given that term in section 2711; and “(6) the term ‘website’ means any collection of material placed in a computer server-based file archive so that it is publicly accessible, over the Internet, using hypertext transfer protocol or any successor protocol.” .

2. 2018

   CyberTipline Modernization Act of 2018

   Pub. L. 115–395 § 3(1) · 132 Stat. 5287

   Substituted · 18 U.S.C. § 2258B

   Pub. L. 115–395, § 3(1), substituted “providers, or domain name registrars” for “electronic communication service providers, remote computing service providers, or domain name registrar” in section catchline

   Source evidence

   Code amendment note
   Pub. L. 115–395, § 3(1), substituted “providers, or domain name registrars” for “electronic communication service providers, remote computing service providers, or domain name registrar” in section catchline.

   Enacted provision · exact public law section
   (1) in the heading— (A) by striking “electronic communication service providers, remote computing service providers,” and inserting “providers”; and (B) by striking “registrar” and inserting “registrars”;

3. 2018

   CyberTipline Modernization Act of 2018

   Pub. L. 115–395 § 3(2) · 132 Stat. 5287

   1. Substituted · 18 U.S.C. § 2258B(a)

      Pub. L. 115–395, § 3(2), substituted “a provider” for “an electronic communication service provider, a remote computing service provider,”

   2. Substituted · 18 U.S.C. § 2258B(a)

      Pub. L. 115–395, § 3(2), substituted “such provider” for “such electronic communication service provider, remote computing service provider,” in two places

   Source evidence

   Code amendment note
   Subsec. (a). Pub. L. 115–395, § 3(2), substituted “a provider” for “an electronic communication service provider, a remote computing service provider,” and substituted “such provider” for “such electronic communication service provider, remote computing service provider,” in two places.

   Enacted provision · exact public law section
   (2) in subsection (a)— (A) by striking “an electronic communication service provider, a remote computing service provider,” and inserting “a provider”; and (B) by striking “such electronic communication service provider, remote computing service provider,” each place it appears and inserting “such provider”;

4. 2018

   CyberTipline Modernization Act of 2018

   Pub. L. 115–395 § 3(3) · 132 Stat. 5287

   Substituted · 18 U.S.C. § 2258B(b)

   Pub. L. 115–395, § 3(3), substituted “provider” for “electronic communication service provider, remote computing service provider,” in two places in introductory provisions

   Source evidence

   Code amendment note
   Subsec. (b). Pub. L. 115–395, § 3(3), substituted “provider” for “electronic communication service provider, remote computing service provider,” in two places in introductory provisions.

   Enacted provision · exact public law section
   (3) in subsection (b), by striking “electronic communication service provider, remote computing service provider,” each place it appears and inserting “provider”; and

5. 2018

   CyberTipline Modernization Act of 2018

   Pub. L. 115–395 § 3(4) · 132 Stat. 5287

   1. Substituted · 18 U.S.C. § 2258B(c)

      Pub. L. 115–395, § 3(4), substituted “A provider” for “An electronic communication service provider, a remote computing service provider,” wherever appearing in pars. (1) and (2)

   2. Substituted · 18 U.S.C. § 2258B(c)

      Pub. L. 115–395, § 3(4), substituted “visual depiction” for “image” wherever appearing in pars. (1) and (2)

   Source evidence

   Code amendment note
   Subsec. (c). Pub. L. 115–395, § 3(4), substituted “A provider” for “An electronic communication service provider, a remote computing service provider,” in introductory provisions and “visual depiction” for “image” wherever appearing in pars. (1) and (2).

   Enacted provision · exact public law section
   (4) in subsection (c)— (A) by striking “image” each place it appears and inserting “visual depiction”; and (B) in the matter preceding paragraph (1), by striking “An electronic communication service provider, a remote computing service provider,” and inserting “A provider”.

6. 2024

   Pub. L. 118–59 § 2(a)(1) · 138 Stat. 1014

   Substituted · 18 U.S.C. § 2258B

   Pub. L. 118–59, § 2(a)(1), substituted “the reporting, storage, and handling of certain visual depictions of apparent child pornography to the National Center for Missing & Exploited Children” for “providers or domain name registrars” in section catchline

   Unresolved: Pub. L. 118–59 was not found in the local Statutes at Large index.

   Source evidence

   Code amendment note
   Pub. L. 118–59, § 2(a)(1), substituted “the reporting, storage, and handling of certain visual depictions of apparent child pornography to the National Center for Missing & Exploited Children” for “providers or domain name registrars” in section catchline.

7. 2024

   Pub. L. 118–59 § 2(a)(2)(A) · 138 Stat. 1014

   Inserted · 18 U.S.C. § 2258B(b)

   Pub. L. 118–59, § 2(a)(2)(A), inserted “or charge” after “a claim” in introductory provisions

   Unresolved: Pub. L. 118–59 was not found in the local Statutes at Large index.

   Source evidence

   Code amendment note
   Subsec. (b). Pub. L. 118–59, § 2(a)(2)(A), inserted “or charge” after “a claim” in introductory provisions.

8. 2024

   Pub. L. 118–59 § 2(a)(2)(B) · 138 Stat. 1014

   Struck · 18 U.S.C. § 2258B(b)(2)(C)

   Pub. L. 118–59, § 2(a)(2)(B), struck out “this section,” after “or function under”

   Unresolved: Pub. L. 118–59 was not found in the local Statutes at Large index.

   Source evidence

   Code amendment note
   Subsec. (b)(2)(C). Pub. L. 118–59, § 2(a)(2)(B), struck out “this section,” after “or function under”.

9. 2024

   Pub. L. 118–59 § 2(a)(3) · 138 Stat. 1014

   Added · 18 U.S.C. § 2258B(d); 18 U.S.C. § 2258B(e)

   Pub. L. 118–59, § 2(a)(3), added subsecs. (d) and (e)

   Unresolved: Pub. L. 118–59 was not found in the local Statutes at Large index.

   Source evidence

   Code amendment note
   Subsecs. (d), (e). Pub. L. 118–59, § 2(a)(3), added subsecs. (d) and (e).

7 of 11 references resolved to an enrolled provision · 4 unresolved