119-s2316

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 2316 Introduced in Senate

    (IS) ]

<DOC>

119th CONGRESS
 1st Session
 S. 2316

 To amend the Controlled Substances Act to require electronic 
communication service providers and remote computing services to report 
 to the Attorney General certain controlled substances violations.

_______________________________________________________________________

 IN THE SENATE OF THE UNITED STATES

 July 17, 2025

Mr. Marshall (for himself, Mrs. Shaheen, Mr. Grassley, Mr. Durbin, Ms. 
Klobuchar, and Mr. Young) introduced the following bill; which was read 
 twice and referred to the Committee on the Judiciary

_______________________________________________________________________

 A BILL

 To amend the Controlled Substances Act to require electronic 
communication service providers and remote computing services to report 
 to the Attorney General certain controlled substances violations.

 Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

 This Act may be cited as the ``Cooper Davis and Devin Norring 
Act''.

SEC. 2. REPORTING REQUIREMENTS OF ELECTRONIC COMMUNICATION SERVICE 
 PROVIDERS AND REMOTE COMPUTING SERVICES FOR CERTAIN 
 CONTROLLED SUBSTANCES VIOLATIONS.

    (a) Amendments to Controlled Substances Act.--

    (1) In general.--Part E of the Controlled Substances Act 
 (21 U.S.C. 871 et seq.) is amended by adding at the end the 
 following:

``

SEC. 521. REPORTING REQUIREMENTS OF ELECTRONIC COMMUNICATION SERVICE 
 PROVIDERS AND REMOTE COMPUTING SERVICES FOR CERTAIN 
 CONTROLLED SUBSTANCES VIOLATIONS.

 ``

    (a) 

=== Definitions. ===
-In this section--
 ``

    (1) the term `electronic communication service' has the 
 meaning given that term in 

section 2510 of title 18, United 
 States Code;
 ``

    (2) the term `electronic mail address' has the meaning 
 given that term in 

section 3 of the CAN-SPAM Act of 2003 (15 
 U.S.C. 7702);
 ``

    (3) the term `Internet' has the meaning given that term 
 in 

section 1101
            (d) (3) of the Internet Tax Freedom Act (47 
 U.S.C. 151 note);
 ``

    (4) the term `provider' means an electronic communication 
 service provider or remote computing service;
 ``

    (5) the term `remote computing service' has the meaning 
 given that term in 

section 2711 of title 18, United States 
 Code; and
 ``

    (6) the term `website' means any collection of material 
 placed in a computer server-based file archive so that it is 
 publicly accessible, over the Internet, using hypertext 
 transfer protocol or any successor protocol.
 ``

    (b) Duty To Report.--
 ``

    (1) General duty.--In order to reduce the proliferation 
 of the unlawful sale, distribution, or manufacture (as 
 applicable) of counterfeit substances and certain controlled 
 substances, a provider shall, as soon as reasonably possible 
 after obtaining actual knowledge of any facts or circumstances 
 described in paragraph

    (2) , and in any event not later than 60 
 days after obtaining such knowledge, submit to the Attorney 
 General a report containing--
 ``
        (A) the mailing address, telephone number, 
 facsimile number, and electronic mailing address of, 
 and individual point of contact for, such provider;
 ``
        (B) information described in subsection
            (c) concerning such facts or circumstances; and
 ``
            (C) for purposes of subsection

    (j) , information 
 indicating whether the facts or circumstances were 
 discovered through content moderation conducted by a 
 human or via a non-human method, including use of an 
 algorithm, machine learning, or other means.
 ``

    (2) Facts or circumstances.--The facts or circumstances 
 described in this paragraph are any facts or circumstances 
 establishing that a crime is being or has already been 
 committed involving--
 ``
        (A) creating, manufacturing, distributing, 
 dispensing, or possession with intent to manufacture, 
 distribute, or dispense--
 ``
            (i) fentanyl; or
 ``
            (ii) methamphetamine;
 ``
        (B) creating, manufacturing, distributing, 
 dispensing, or possession with intent to manufacture, 
 distribute, or dispense a counterfeit substance, 
 including a counterfeit substance purporting to be a 
 prescription drug; or
 ``
            (C) creating, manufacturing, distributing, 
 dispensing, or possession with intent to manufacture, 
 distribute, or dispense an actual or purported 
 prescription pain medication or prescription stimulant 
 by any individual or entity that is not authorized, 
 which includes an individual or entity that falsely 
 claims to be a practitioner.
 ``

    (3) Permitted actions based on reasonable belief.--In 
 order to reduce the proliferation of the unlawful sale, 
 distribution, or manufacture (as applicable) of counterfeit 
 substances and certain controlled substances, if a provider has 
 a reasonable belief that facts or circumstances described in 
 paragraph

    (2) exist, the provider may submit to the Attorney 
 General a report described in paragraph

    (1) .
 ``
            (c) Contents of Report.--
 ``

    (1) In general.--To the extent the information is within 
 the custody or control of a provider, the facts or 
 circumstances included in each report under subsection

    (b)

    (1) --
 ``
        (A) shall include, to the extent that it is 
 applicable and reasonably available, information 
 relating to the account involved in the commission of a 
 crime described in subsection

    (b)

    (2) , such as the name, 
 address, electronic mail address, user or account 
 identification, Internet Protocol address, uniform 
 resource locator, screen names or monikers for the 
 account used or any other accounts associated with the 
 account user, or any other identifying information, 
 including self-reported identifying information, but 
 not including the contents of a wire communication or 
 electronic communication, as those terms are defined in 
 

section 2510 of title 18, United States Code, except as 
 provided in subparagraph
        (B) of this paragraph; and
 ``
        (B) may, at the sole discretion of the provider, 
 include the information described in paragraph

    (2) of 
 this subsection.
 ``

    (2) Other information.--The information referred to in 
 paragraph

    (1)
        (B) is the following:
 ``
        (A) Historical reference.--Information relating 
 to when and how a user, subscriber, or customer of a 
 provider uploaded, transmitted, or received content 
 relating to the report or when and how content relating 
 to the report was reported to or discovered by the 
 provider, including a date and time stamp and time 
 zone.
 ``
        (B) Geographic location information.--Information 
 relating to the geographic location of the involved 
 individual or website, which may include the Internet 
 Protocol address or verified address, or, if not 
 reasonably available, at least one form of geographic 
 identifying information, including area code or ZIP 
 Code, provided by the user, subscriber, or customer, or 
 stored or obtained by the provider, and any information 
 as to whether a virtual private network was used.
 ``
            (C) Data relating to facts or circumstances.--Any 
 data, including symbols, photos, video, icons, or 
 direct messages, relating to activity involving the 
 facts or circumstances described in subsection

    (b)

    (2) or other content relating to the crime.
 ``
            (D) Complete communication.--The complete 
 communication containing the information of the crime 
 described in subsection

    (b)

    (2) , including--
 ``
            (i) any data or information regarding the 
 transmission of the communication; and
 ``
            (ii) any data or other digital files 
 contained in, or attached to, the 
 communication.
 ``

    (3) User, subscriber, or customer submitted reports.--In 
 the case of a report under subsection

    (b)

    (3) , the provider may, 
 at its sole discretion, include in the report information 
 submitted to the provider by a user, subscriber, or customer 
 alleging facts or circumstances described in subsection

    (b)

    (2) if the provider, upon review, has a reasonable belief that the 
 alleged facts or circumstances exist.
 ``
            (d) Handling of Reports.--Upon receipt of a report submitted 
under subsection

    (b) , the Attorney General--
 ``

    (1) shall conduct a preliminary review of such report; 
 and
 ``

    (2) after completing the preliminary review, shall--
 ``
        (A) conduct further investigation of the report, 
 which may include making the report available to other 
 Federal, State, or local law enforcement agencies 
 involved in the investigation of crimes described in 
 subsection

    (b)

    (2) , if the Attorney General determines 
 that the report facially contains sufficient 
 information to warrant and permit further 
 investigation; or
 ``
        (B) conclude that no further investigative steps 
 are warranted or possible, or that insufficient 
 evidence exists to make a determination, and close the 
 report.
 ``

    (e) Attorney General Responsibilities.--
 ``

    (1) In general.--The Attorney General shall enforce this 
 section.
 ``

    (2) Designation of federal agencies.--The Attorney 
 General may designate a Federal law enforcement agency or 
 agencies to which the Attorney General may forward a report 
 under subsection
            (d) .
 ``

    (3) Data minimization requirements.--The Attorney General 
 shall take reasonable measures to--
 ``
        (A) limit the storage of a report submitted under 
 subsection

    (b) and its contents to the amount that is 
 necessary to carry out the investigation of crimes 
 described in subsection

    (b)

    (2) ; and
 ``
        (B) store a report submitted under subsection

    (b) and its contents only as long as is reasonably 
 necessary to carry out an investigation of crimes 
 described in subsection

    (b)

    (2) or make the report 
 available to other agencies under subsection
            (d) (2)
        (A) , 
 after which time the report and its contents shall be 
 deleted unless the preservation of a report has future 
 evidentiary value.
 ``

    (f) Failure To Comply With Requirements.--
 ``

    (1) Criminal penalty.--
 ``
        (A) Offense.--It shall be unlawful for a provider 
 to knowingly fail to submit a report required under 
 subsection

    (b)

    (1) .
 ``
        (B) Penalty.--A provider that violates 
 subparagraph
        (A) shall be fined--
 ``
            (i) in the case of an initial violation, 
 not more than $190,000; and
 ``
            (ii) in the case of any second or 
 subsequent violation, not more than $380,000.
 ``

    (2) Civil penalty.--In addition to any other available 
 civil or criminal penalty, a provider shall be liable to the 
 United States Government for a civil penalty in an amount not 
 less than $50,000 and not more than $100,000 if the provider 
 knowingly submits a report under subsection

    (b) that--
 ``
        (A) contains materially false or fraudulent 
 information; or
 ``
        (B) omits information described in subsection
            (c) (1)
        (A) that is reasonably available.
 ``

    (g) Protection of Privacy.--Nothing in this section shall be 
construed to--
 ``

    (1) require a provider to monitor any user, subscriber, 
 or customer of that provider;
 ``

    (2) require a provider to monitor the content of any 
 communication of any person described in paragraph

    (1) ;
 ``

    (3) require a provider to affirmatively search, screen, 
 or scan for facts or circumstances described in subsection

    (b)

    (2) ;
 ``

    (4) permit actual knowledge to be proven based solely on 
 a provider's decision not to engage in additional verification 
 or investigation to discover facts and circumstances that are 
 not readily apparent, so long as the provider does not 
 deliberately blind itself to those violations; or
 ``

    (5) prohibit a provider from using end-to-end encryption 
 or require a provider to decrypt encrypted communications.
 ``

    (h) Conditions of Disclosure of Information Contained Within 
Report.--
 ``

    (1) In general.--Except as provided in paragraph

    (2) , a 
 law enforcement agency that receives a report under subsection
            (d) shall not disclose any information contained in that 
 report.
 ``

    (2) Permitted disclosures by law enforcement.--A law 
 enforcement agency may disclose information in a report 
 received under subsection
            (d) --
 ``
        (A) to an attorney for the government for use in 
 the performance of the official duties of that 
 attorney, including providing discovery to a defendant;
 ``
        (B) to such officers and employees of that law 
 enforcement agency, as may be necessary in the 
 performance of their investigative and recordkeeping 
 functions;
 ``
            (C) to such other government personnel (including 
 personnel of a State or subdivision of a State) as are 
 determined to be necessary by an attorney for the 
 government to assist the attorney in the performance of 
 the official duties of the attorney in enforcing 
 Federal criminal law;
 ``
            (D) if the report discloses an apparent violation 
 of State criminal law, to an appropriate official of a 
 State or subdivision of a State for the purpose of 
 enforcing such State law;
 ``
        (E) to a defendant in a criminal case or the 
 attorney for that defendant to the extent the 
 information relates to a criminal charge pending 
 against that defendant;
 ``
        (F) to a provider if necessary to facilitate 
 response to legal process issued in connection to a 
 criminal investigation, prosecution, or post-conviction 
 remedy relating to that report;
 ``
        (G) as ordered by a court upon a showing of good 
 cause and pursuant to any protective orders or other 
 conditions that the court may impose; and
 ``
        (H) in order to facilitate the enforcement of the 
 penalties authorized under subsection

    (f) .
 ``
            (i) Preservation.--
 ``

    (1) In general.--
 ``
        (A) Request to preserve contents.--
 ``
            (i) In general.--Subject to clause
            (ii) , 
 for the purposes of this section, a completed 
 submission by a provider of a report to the 
 Attorney General under subsection

    (b)

    (1) shall 
 be treated as a request to preserve the 
 contents provided in the report, and any data 
 or other digital files that are reasonably 
 accessible and may provide context or 
 additional information about the reported 
 material or person, for 90 days after the 
 submission to the Attorney General.
 ``
            (ii) Limitations on extension of 
 preservation period.--
 ``
            (I) Stored communications act.--
 The Attorney General may not submit a 
 request to a provider to continue 
 preservation of the contents of a 
 report or other data described in 
 clause
            (i) under 

section 2703

    (f) of 
 title 18, United States Code, beyond 
 the required period of preservation 
 under clause
            (i) of this subparagraph 
 unless the Attorney General has an 
 active or pending investigation 
 involving the user, subscriber, or 
 customer account at issue in the 
 report.
 ``
            (II) Rule of construction.--
 Nothing in subclause
            (I) shall preclude 
 another Federal, State, or local law 
 enforcement agency from seeking 
 continued preservation of the contents 
 of a report or other data described in 
 clause
            (i) under 

section 2703

    (f) of 
 title 18, United States Code.
 ``
        (B) Notification to user.--A provider may not 
 notify a user, subscriber, or customer of the provider 
 of a preservation request described in subparagraph
        (A) unless--
 ``
            (i) the provider has notified the 
 Attorney General of its intent to provide that 
 notice; and
 ``
            (ii) 45 business days have elapsed since 
 the notification under clause
            (i) .
 ``

    (2) Protection of preserved materials.--A provider 
 preserving materials under this section shall maintain the 
 materials in a secure location and take appropriate steps to 
 limit access to the materials by agents or employees of the 
 provider to that access necessary to comply with the 
 requirements of this subsection.
 ``

    (3) Authorities and duties not affected.--Nothing in this 
 section shall be construed as replacing, amending, or otherwise 
 interfering with the authorities and duties under 

section 2703 
 of title 18, United States Code.
 ``

    (4) Relation to reporting requirement.--Submission of a 
 report as required by subsection

    (b)

    (1) does not satisfy the 
 obligations under this subsection.
 ``

    (j) Annual Report.--Not later than 1 year after the date of 
enactment of the Cooper Davis and Devin Norring Act, and annually 
thereafter, the Attorney General shall publish a report that includes, 
for the reporting period--
 ``

    (1) the total number of reports received from providers 
 under subsection

    (b)

    (1) ;
 ``

    (2) the number of reports received under subsection

    (b)

    (1) disaggregated by--
 ``
        (A) the provider on whose electronic 
 communication service or remote computing service the 
 crime for which there are facts or circumstances 
 occurred; and
 ``
        (B) the subsidiary of a provider, if any, on 
 whose electronic communication service or remote 
 computing service the crime for which there are facts 
 or circumstances occurred;
 ``

    (3) the number of reports received under subsection

    (b)

    (1) that led to convictions in cases investigated by the 
 Attorney General;
 ``

    (4) the number of reports received under subsection

    (b)

    (1) that lacked actionable information;
 ``

    (5) the number of reports received under subsection

    (b)

    (1) where the facts or circumstances of a crime were 
 discovered through--
 ``
        (A) content moderation conducted by a human; or
 ``
        (B) a non-human method including use of an 
 algorithm, machine learning, or other means;
 ``

    (6) the number of reports received under subsection

    (b)

    (1) that were made available to other law enforcement 
 agencies, disaggregated by--
 ``
        (A) the number of reports made available to 
 Federal law enforcement agencies;
 ``
        (B) the number of reports made available to State 
 law enforcement agencies; and
 ``
            (C) the number of reports made available to local 
 law enforcement agencies; and
 ``

    (7) the number of requests to providers to continue 
 preservation of the contents of a report or other data 
 described in subsection
            (i) (1)
        (A)
            (i) submitted by the Attorney 
 General under 

section 2703

    (f) of title 18, United States Code.
 ``

    (k) Prohibition on Submission of User, Subscriber, Customer, or 
Anonymous Reports by Law Enforcement.--
 ``

    (1) In general.--No Federal, Tribal, State, or local law 
 enforcement officer acting in an official capacity may submit a 
 report to a provider or arrange for another individual to 
 submit a report to a provider on behalf of the officer under 
 this section.
 ``

    (2) Remedy for violation.--No part of the contents of a 
 provider's report made under subsection

    (b)

    (1) or

    (b)

    (3) and no 
 evidence derived therefrom may be received in evidence in any 
 trial, hearing, or other proceeding in or before any court, 
 department, officer, agency, regulatory body, legislative 
 committee, or other authority of the United States, a State, or 
 a political subdivision thereof if that provider report 
 resulted from an action prohibited by paragraph

    (1) of this 
 subsection.
 ``
            (l) Exemption for Providers of Broadband Internet Access Service 
and Text Messaging Service.--Subsections

    (b) through

    (k) shall not 
apply to a provider of--
 ``

    (1) broadband internet access service, as that term is 
 defined in 

section 8.1

    (b) of title 47, Code of Federal 
 Regulations (or any successor regulation), insofar as the 
 provider is acting as a provider of such service; or
 ``

    (2) text messaging service, as that term is defined in 
 

section 227

    (e)

    (8) of title 47, United States Code, insofar as 
 the provider is acting as a provider of such service.''.

    (2) Technical and conforming amendment.--The table of 
 contents for the Comprehensive Drug Abuse Prevention and 
 Control Act of 1970 (Public Law 91-513; 84 Stat. 1236) is 
 amended by inserting after the item relating to 

section 520 the 
 following:

``

Sec. 521. Reporting requirements of electronic communication service 
 providers and remote computing services for 
 certain controlled substances 
 violations.''.

    (b) Conforming Amendments to Stored Communications Act.--

    (1) In general.--

Section 2702 of title 18, United States 
 Code, is amended--
        (A) in subsection

    (b) --
            (i) in paragraph

    (8) , by striking ``or'' at 
 the end;
            (ii) in paragraph

    (9) , by striking the 
 period at the end and inserting ``; or''; and
            (iii) by adding at the end the following:
 ``

    (10) to the Attorney General, in connection with a report 
 submitted thereto under 

section 521 of the Controlled 
 Substances Act.''; and
        (B) in subsection
            (c) --
            (i) in paragraph

    (6) , by striking ``or'' at 
 the end;
            (ii) in paragraph

    (7) , by striking the 
 period at the end and inserting ``; or''; and
            (iii) by adding at the end the following:
 ``

    (8) to the Attorney General, in connection with a report 
 submitted thereto under 

section 521 of the Controlled 
 Substances Act.''.

    (2) Technical amendment.--Paragraph

    (7) of 

section 2702

    (b) of title 18, United States Code, is amended to read as follows:
 ``

    (7) to a law enforcement agency if the contents--
 ``
        (A) were inadvertently obtained by the service 
 provider; and
 ``
        (B) appear to pertain to the commission of a 
 crime;''.

SEC. 3. SEVERABILITY.

 If any provision of this Act or amendment made by this Act, or the 
application of such a provision or amendment to any person or 
circumstance, is held to be unconstitutional, the remaining provisions 
of this Act and amendments made by this Act, and the application of 
such provision or amendment to any other person or circumstance, shall 
not be affected thereby.
 <all>