[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[H.R. 8918 Introduced in House (IH)]
<DOC>
118th CONGRESS
2d Session
H. R. 8918
To amend the Controlled Substances Act to require electronic
communication service providers and remote computing services to report
to the Attorney General certain controlled substances violations.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
July 2, 2024
Ms. Craig (for herself, Mrs. Miller-Meeks, Ms. Schrier, Mr. Crenshaw,
Mr. Davis of North Carolina, and Mr. LaTurner) introduced the following
bill; which was referred to the Committee on Energy and Commerce, and
in addition to the Committee on the Judiciary, for a period to be
subsequently determined by the Speaker, in each case for consideration
of such provisions as fall within the jurisdiction of the committee
concerned
_______________________________________________________________________
A BILL
To amend the Controlled Substances Act to require electronic
communication service providers and remote computing services to report
to the Attorney General certain controlled substances violations.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Cooper Davis and Devin Norring
Act''.
SEC. 2. REPORTING REQUIREMENTS OF ELECTRONIC COMMUNICATION SERVICE
PROVIDERS AND REMOTE COMPUTING SERVICES FOR CERTAIN
CONTROLLED SUBSTANCES VIOLATIONS.
(a) Amendments to Controlled Substances Act.--
(1) In general.--Part E of the Controlled Substances Act
(21 U.S.C. 871 et seq.) is amended by adding at the end the
following:
``reporting requirements of electronic communication service providers
and remote computing services for certain controlled substances
violations
``Sec. 521. (a) Definitions.--In this section--
``(1) the term `electronic communication service' has the
meaning given that term in section 2510 of title 18, United
States Code;
``(2) the term `electronic mail address' has the meaning
given that term in section 3 of the CAN-SPAM Act of 2003 (15
U.S.C. 7702);
``(3) the term `Internet' has the meaning given that term
in section 1101 of the Internet Tax Freedom Act (47 U.S.C. 151
note);
``(4) the term `provider' means an electronic communication
service provider or remote computing service;
``(5) the term `remote computing service' has the meaning
given that term in section 2711 of title 18, United States
Code; and
``(6) the term `website' means any collection of material
placed in a computer server-based file archive so that it is
publicly accessible, over the Internet, using hypertext
transfer protocol or any successor protocol.
``(b) Duty To Report.--
``(1) General duty.--In order to reduce the proliferation
of the unlawful sale, distribution, or manufacture (as
applicable) of counterfeit substances and certain controlled
substances, a provider shall, as soon as reasonably possible
after obtaining actual knowledge of any facts or circumstances
described in paragraph (2), and in any event not later than 60
days after obtaining such knowledge, submit to the Drug
Enforcement Administration a report containing--
``(A) the mailing address, telephone number,
facsimile number, and electronic mailing address of,
and individual point of contact for, such provider;
``(B) information described in subsection (c)
concerning such facts or circumstances; and
``(C) for purposes of subsection (j), information
indicating whether the facts or circumstances were
discovered through content moderation conducted by a
human or via a non-human method, including use of an
algorithm, machine learning, or other means.
``(2) Facts or circumstances.--The facts or circumstances
described in this paragraph are any facts or circumstances
establishing that a crime is being or has already been
committed involving--
``(A) creating, manufacturing, distributing,
dispensing, or possession with intent to manufacture,
distribute, or dispense--
``(i) fentanyl; or
``(ii) methamphetamine;
``(B) creating, manufacturing, distributing,
dispensing, or possession with intent to manufacture,
distribute, or dispense a counterfeit substance,
including a counterfeit substance purporting to be a
prescription drug; or
``(C) offering, dispensing, or administering an
actual or purported prescription pain medication or
prescription stimulant by any individual or entity that
is not a practitioner or online pharmacy, including an
individual or entity that falsely claims to be a
practitioner or online pharmacy.
``(3) Permitted actions based on reasonable belief.--In
order to reduce the proliferation of the unlawful sale,
distribution, or manufacture (as applicable) of counterfeit
substances and certain controlled substances, if a provider has
a reasonable belief that facts or circumstances described in
paragraph (2) exist, the provider may submit to the Drug
Enforcement Administration a report described in paragraph (1).
``(c) Contents of Report.--
``(1) In general.--To the extent the information is within
the custody or control of a provider, the facts or
circumstances included in each report under subsection (b)(1)--
``(A) shall include, to the extent that it is
applicable and reasonably available, information
relating to the account involved in the commission of a
crime described in subsection (b)(2), such as the name,
address, electronic mail address, user or account
identification, Internet Protocol address, uniform
resource locator, screen names or monikers for the
account used or any other accounts associated with the
account user, or any other identifying information,
including self-reported identifying information, but
not including the contents of a wire communication or
electronic communication, as those terms are defined in
section 2510 of title 18, United States Code, except as
provided in subparagraph (B) of this paragraph; and
``(B) may, at the sole discretion of the provider,
include the information described in paragraph (2) of
this subsection.
``(2) Other information.--The information referred to in
paragraph (1)(B) is the following:
``(A) Historical reference.--Information relating
to when and how a user, subscriber, or customer of a
provider uploaded, transmitted, or received content
relating to the report or when and how content relating
to the report was reported to or discovered by the
provider, including a date and time stamp and time
zone.
``(B) Geographic location information.--Information
relating to the geographic location of the involved
individual or website, which may include the Internet
Protocol address or verified address, or, if not
reasonably available, at least one form of geographic
identifying information, including area code or ZIP
Code, provided by the user, subscriber, or customer, or
stored or obtained by the provider, and any information
as to whether a virtual private network was used.
``(C) Data relating to facts or circumstances.--Any
data, including symbols, photos, video, icons, or
direct messages, relating to activity involving the
facts or circumstances described in subsection (b)(2)
or other content relating to the crime.
``(D) Complete communication.--The complete
communication containing the information of the crime
described in subsection (b)(2), including--
``(i) any data or information regarding the
transmission of the communication; and
``(ii) any data or other digital files
contained in, or attached to, the
communication.
``(3) User, subscriber, or customer submitted reports.--In
the case of a report under subsection (b)(3), the provider may,
at its sole discretion, include in the report information
submitted to the provider by a user, subscriber, or customer
alleging facts or circumstances described in subsection (b)(2)
if the provider, upon review, has a reasonable belief that the
alleged facts or circumstances exist.
``(d) Handling of Reports.--Upon receipt of a report submitted
under subsection (b), the Administrator of the Drug Enforcement
Administration--
``(1) shall conduct a preliminary review of such report;
and
``(2) after completing the preliminary review, shall--
``(A) conduct further investigation of the report,
which may include making the report available to other
Federal, State, or local law enforcement agencies
involved in the investigation of crimes described in
subsection (b)(2), if the Administrator determines that
the report facially contains sufficient information to
warrant and permit further investigation; or
``(B) conclude that no further investigative steps
are warranted or possible, or that insufficient
evidence exists to make a determination, and close the
report.
``(e) Attorney General Responsibilities.--
``(1) In general.--The Attorney General shall enforce this
section.
``(2) Designation of federal agencies.--The Attorney
General may designate a Federal law enforcement agency or
agencies to which the Drug Enforcement Administration may
forward a report under subsection (d).
``(3) Data minimization requirements.--The Attorney General
shall take reasonable measures to--
``(A) limit the storage of a report submitted under
subsection (b) and its contents to the amount that is
necessary to carry out the investigation of crimes
described in subsection (b)(2); and
``(B) store a report submitted under subsection (b)
and its contents only as long as is reasonably
necessary to carry out an investigation of crimes
described in subsection (b)(2) or make the report
available to other agencies under subsection (d)(2)(A),
after which time the report and its contents shall be
deleted unless the preservation of a report has future
evidentiary value.
``(f) Failure To Comply With Requirements.--
``(1) Criminal penalty.--
``(A) Offense.--It shall be unlawful for a provider
to knowingly fail to submit a report required under
subsection (b)(1).
``(B) Penalty.--A provider that violates
subparagraph (A) shall be fined--
``(i) in the case of an initial violation,
not more than $190,000; and
``(ii) in the case of any second or
subsequent violation, not more than $380,000.
``(2) Civil penalty.--In addition to any other available
civil or criminal penalty, a provider shall be liable to the
United States Government for a civil penalty in an amount not
less than $50,000 and not more than $100,000 if the provider
knowingly submits a report under subsection (b) that--
``(A) contains materially false or fraudulent
information; or
``(B) omits information described in subsection
(c)(1)(A) that is reasonably available.
``(g) Protection of Privacy.--Nothing in this section shall be
construed to--
``(1) require a provider to monitor any user, subscriber,
or customer of that provider;
``(2) require a provider to monitor the content of any
communication of any person described in paragraph (1);
``(3) require a provider to affirmatively search, screen,
or scan for facts or circumstances described in subsection
(b)(2);
``(4) permit actual knowledge to be proven based solely on
a provider's decision not to engage in additional verification
or investigation to discover facts and circumstances that are
not readily apparent, so long as the provider does not
deliberately blind itself to those violations; or
``(5) prohibit a provider from using end-to-end encryption
or require a provider to decrypt encrypted communications.
``(h) Conditions of Disclosure of Information Contained Within
Report.--
``(1) In general.--Except as provided in paragraph (2), a
law enforcement agency that receives a report under subsection
(d) shall not disclose any information contained in that
report.
``(2) Permitted disclosures by law enforcement.--A law
enforcement agency may disclose information in a report
received under subsection (d)--
``(A) to an attorney for the government for use in
the performance of the official duties of that
attorney, including providing discovery to a defendant;
``(B) to such officers and employees of that law
enforcement agency, as may be necessary in the
performance of their investigative and recordkeeping
functions;
``(C) to such other government personnel (including
personnel of a State or subdivision of a State) as are
determined to be necessary by an attorney for the
government to assist the attorney in the performance of
the official duties of the attorney in enforcing
Federal criminal law;
``(D) if the report discloses an apparent violation
of State criminal law, to an appropriate official of a
State or subdivision of a State for the purpose of
enforcing such State law;
``(E) to a defendant in a criminal case or the
attorney for that defendant to the extent the
information relates to a criminal charge pending
against that defendant;
``(F) to a provider if necessary to facilitate
response to legal process issued in connection to a
criminal investigation, prosecution, or post-conviction
remedy relating to that report;
``(G) as ordered by a court upon a showing of good
cause and pursuant to any protective orders or other
conditions that the court may impose; and
``(H) in order to facilitate the enforcement of the
penalties authorized under subsection (f).
``(i) Preservation.--
``(1) In general.--
``(A) Request to preserve contents.--
``(i) In general.--Subject to clause (ii),
for the purposes of this section, a completed
submission by a provider of a report to the
Drug Enforcement Administration under
subsection (b)(1) shall be treated as a request
to preserve the contents provided in the
report, and any data or other digital files
that are reasonably accessible and may provide
context or additional information about the
reported material or person, for 90 days after
the submission to the Drug Enforcement
Administration.
``(ii) Limitations on extension of
preservation period.--
``(I) Stored communications act.--
The Drug Enforcement Administration may
not submit a request to a provider to
continue preservation of the contents
of a report or other data described in
clause (i) under section 2703(f) of
title 18, United States Code, beyond
the required period of preservation
under clause (i) of this subparagraph
unless the Drug Enforcement
Administration has an active or pending
investigation involving the user,
subscriber, or customer account at
issue in the report.
``(II) Rule of construction.--
Nothing in subclause (I) shall preclude
another Federal, State, or local law
enforcement agency from seeking
continued preservation of the contents
of a report or other data described in
clause (i) under section 2703(f) of
title 18, United States Code.
``(B) Notification to user.--A provider may not
notify a user, subscriber, or customer of the provider
of a preservation request described in subparagraph (A)
unless--
``(i) the provider has notified the Drug
Enforcement Administration of its intent to
provide that notice; and
``(ii) 45 business days have elapsed since