S2316-119

2. Reporting requirements of electronic communication service providers and remote computing services for certain controlled substances violations Part E of the Controlled Substances Act (21 U.S.C. 871 et seq.) is amended by adding at the end the following: In this section— the term electronic communication service has the meaning given that term in section 2510 of title 18, United States Code; the term electronic mail address has the meaning given that term in section 3 of the CAN-SPAM Act of 2003 (15 U.S.C. 7702); the term Internet has the meaning given that term in section 1101(d)(3) of the Internet Tax Freedom Act (47 U.S.C. 151 note); the term provider means an electronic communication service provider or remote computing service; the term remote computing service has the meaning given that term in section 2711 of title 18, United States Code; and the term website means any collection of material placed in a computer server-based file archive so that it is publicly accessible, over the Internet, using hypertext transfer protocol or any successor protocol. In order to reduce the proliferation of the unlawful sale, distribution, or manufacture (as applicable) of counterfeit substances and certain controlled substances, a provider shall, as soon as reasonably possible after obtaining actual knowledge of any facts or circumstances described in paragraph (2), and in any event not later than 60 days after obtaining such knowledge, submit to the Attorney General a report containing— the mailing address, telephone number, facsimile number, and electronic mailing address of, and individual point of contact for, such provider; information described in subsection (c) concerning such facts or circumstances; and for purposes of subsection (j), information indicating whether the facts or circumstances were discovered through content moderation conducted by a human or via a non-human method, including use of an algorithm, machine learning, or other means. The facts or circumstances described in this paragraph are any facts or circumstances establishing that a crime is being or has already been committed involving— creating, manufacturing, distributing, dispensing, or possession with intent to manufacture, distribute, or dispense— fentanyl; or methamphetamine; creating, manufacturing, distributing, dispensing, or possession with intent to manufacture, distribute, or dispense a counterfeit substance, including a counterfeit substance purporting to be a prescription drug; or creating, manufacturing, distributing, dispensing, or possession with intent to manufacture, distribute, or dispense an actual or purported prescription pain medication or prescription stimulant by any individual or entity that is not authorized, which includes an individual or entity that falsely claims to be a practitioner. In order to reduce the proliferation of the unlawful sale, distribution, or manufacture (as applicable) of counterfeit substances and certain controlled substances, if a provider has a reasonable belief that facts or circumstances described in paragraph (2) exist, the provider may submit to the Attorney General a report described in paragraph (1). To the extent the information is within the custody or control of a provider, the facts or circumstances included in each report under subsection (b)(1)— shall include, to the extent that it is applicable and reasonably available, information relating to the account involved in the commission of a crime described in subsection (b)(2), such as the name, address, electronic mail address, user or account identification, Internet Protocol address, uniform resource locator, screen names or monikers for the account used or any other accounts associated with the account user, or any other identifying information, including self-reported identifying information, but not including the contents of a wire communication or electronic communication, as those terms are defined in section 2510 of title 18, United States Code, except as provided in subparagraph (B) of this paragraph; and may, at the sole discretion of the provider, include the information described in paragraph (2) of this subsection. The information referred to in paragraph (1)(B) is the following: Information relating to when and how a user, subscriber, or customer of a provider uploaded, transmitted, or received content relating to the report or when and how content relating to the report was reported to or discovered by the provider, including a date and time stamp and time zone. Information relating to the geographic location of the involved individual or website, which may include the Internet Protocol address or verified address, or, if not reasonably available, at least one form of geographic identifying information, including area code or ZIP Code, provided by the user, subscriber, or customer, or stored or obtained by the provider, and any information as to whether a virtual private network was used. Any data, including symbols, photos, video, icons, or direct messages, relating to activity involving the facts or circumstances described in subsection (b)(2) or other content relating to the crime. The complete communication containing the information of the crime described in subsection (b)(2), including— any data or information regarding the transmission of the communication; and any data or other digital files contained in, or attached to, the communication. In the case of a report under subsection (b)(3), the provider may, at its sole discretion, include in the report information submitted to the provider by a user, subscriber, or customer alleging facts or circumstances described in subsection (b)(2) if the provider, upon review, has a reasonable belief that the alleged facts or circumstances exist. Upon receipt of a report submitted under subsection (b), the Attorney General— shall conduct a preliminary review of such report; and after completing the preliminary review, shall— conduct further investigation of the report, which may include making the report available to other Federal, State, or local law enforcement agencies involved in the investigation of crimes described in subsection (b)(2), if the Attorney General determines that the report facially contains sufficient information to warrant and permit further investigation; or conclude that no further investigative steps are warranted or possible, or that insufficient evidence exists to make a determination, and close the report. The Attorney General shall enforce this section. The Attorney General may designate a Federal law enforcement agency or agencies to which the Attorney General may forward a report under subsection (d). The Attorney General shall take reasonable measures to— limit the storage of a report submitted under subsection (b) and its contents to the amount that is necessary to carry out the investigation of crimes described in subsection (b)(2); and store a report submitted under subsection (b) and its contents only as long as is reasonably necessary to carry out an investigation of crimes described in subsection (b)(2) or make the report available to other agencies under subsection (d)(2)(A), after which time the report and its contents shall be deleted unless the preservation of a report has future evidentiary value. It shall be unlawful for a provider to knowingly fail to submit a report required under subsection (b)(1). A provider that violates subparagraph (A) shall be fined— in the case of an initial violation, not more than $190,000; and in the case of any second or subsequent violation, not more than $380,000. In addition to any other available civil or criminal penalty, a provider shall be liable to the United States Government for a civil penalty in an amount not less than $50,000 and not more than $100,000 if the provider knowingly submits a report under subsection (b) that— contains materially false or fraudulent information; or omits information described in subsection (c)(1)(A) that is reasonably available. Nothing in this section shall be construed to— require a provider to monitor any user, subscriber, or customer of that provider; require a provider to monitor the content of any communication of any person described in paragraph (1); require a provider to affirmatively search, screen, or scan for facts or circumstances described in subsection (b)(2); permit actual knowledge to be proven based solely on a provider’s decision not to engage in additional verification or investigation to discover facts and circumstances that are not readily apparent, so long as the provider does not deliberately blind itself to those violations; or prohibit a provider from using end-to-end encryption or require a provider to decrypt encrypted communications. Except as provided in paragraph (2), a law enforcement agency that receives a report under subsection (d) shall not disclose any information contained in that report. A law enforcement agency may disclose information in a report received under subsection (d)— to an attorney for the government for use in the performance of the official duties of that attorney, including providing discovery to a defendant; to such officers and employees of that law enforcement agency, as may be necessary in the performance of their investigative and recordkeeping functions; to such other government personnel (including personnel of a State or subdivision of a State) as are determined to be necessary by an attorney for the government to assist the attorney in the performance of the official duties of the attorney in enforcing Federal criminal law; if the report discloses an apparent violation of State criminal law, to an appropriate official of a State or subdivision of a State for the purpose of enforcing such State law; to a defendant in a criminal case or the attorney for that defendant to the extent the information relates to a criminal charge pending against that defendant; to a provider if necessary to facilitate response to legal process issued in connection to a criminal investigation, prosecution, or post-conviction remedy relating to that report; as ordered by a court upon a showing of good cause and pursuant to any protective orders or other conditions that the court may impose; and in order to facilitate the enforcement of the penalties authorized under subsection (f). Subject to clause (ii), for the purposes of this section, a completed submission by a provider of a report to the Attorney General under subsection (b)(1) shall be treated as a request to preserve the contents provided in the report, and any data or other digital files that are reasonably accessible and may provide context or additional information about the reported material or person, for 90 days after the submission to the Attorney General. The Attorney General may not submit a request to a provider to continue preservation of the contents of a report or other data described in clause (i) under section 2703(f) of title 18, United States Code, beyond the required period of preservation under clause (i) of this subparagraph unless the Attorney General has an active or pending investigation involving the user, subscriber, or customer account at issue in the report. Nothing in subclause (I) shall preclude another Federal, State, or local law enforcement agency from seeking continued preservation of the contents of a report or other data described in clause (i) under section 2703(f) of title 18, United States Code. A provider may not notify a user, subscriber, or customer of the provider of a preservation request described in subparagraph (A) unless— the provider has notified the Attorney General of its intent to provide that notice; and 45 business days have elapsed since the notification under clause (i). A provider preserving materials under this section shall maintain the materials in a secure location and take appropriate steps to limit access to the materials by agents or employees of the provider to that access necessary to comply with the requirements of this subsection. Nothing in this section shall be construed as replacing, amending, or otherwise interfering with the authorities and duties under section 2703 of title 18, United States Code. Submission of a report as required by subsection (b)(1) does not satisfy the obligations under this subsection. Not later than 1 year after the date of enactment of the Cooper Davis and Devin Norring Act, and annually thereafter, the Attorney General shall publish a report that includes, for the reporting period— the total number of reports received from providers under subsection (b)(1); the number of reports received under subsection (b)(1) disaggregated by— the provider on whose electronic communication service or remote computing service the crime for which there are facts or circumstances occurred; and the subsidiary of a provider, if any, on whose electronic communication service or remote computing service the crime for which there are facts or circumstances occurred; the number of reports received under subsection (b)(1) that led to convictions in cases investigated by the Attorney General; the number of reports received under subsection (b)(1) that lacked actionable information; the number of reports received under subsection (b)(1) where the facts or circumstances of a crime were discovered through— content moderation conducted by a human; or a non-human method including use of an algorithm, machine learning, or other means; the number of reports received under subsection (b)(1) that were made available to other law enforcement agencies, disaggregated by— the number of reports made available to Federal law enforcement agencies; the number of reports made available to State law enforcement agencies; and the number of reports made available to local law enforcement agencies; and the number of requests to providers to continue preservation of the contents of a report or other data described in subsection (i)(1)(A)(i) submitted by the Attorney General under section 2703(f) of title 18, United States Code. No Federal, Tribal, State, or local law enforcement officer acting in an official capacity may submit a report to a provider or arrange for another individual to submit a report to a provider on behalf of the officer under this section. No part of the contents of a provider’s report made under subsection (b)(1) or (b)(3) and no evidence derived therefrom may be received in evidence in any trial, hearing, or other proceeding in or before any court, department, officer, agency, regulatory body, legislative committee, or other authority of the United States, a State, or a political subdivision thereof if that provider report resulted from an action prohibited by paragraph (1) of this subsection. Subsections (b) through (k) shall not apply to a provider of— broadband internet access service, as that term is defined in section 8.1(b) of title 47, Code of Federal Regulations (or any successor regulation), insofar as the provider is acting as a provider of such service; or text messaging service, as that term is defined in section 227(e)(8) of title 47, United States Code, insofar as the provider is acting as a provider of such service. The table of contents for the Comprehensive Drug Abuse Prevention and Control Act of 1970 (Public Law 91–513; 84 Stat. 1236) is amended by inserting after the item relating to section 520 the following: Section 2702 of title 18, United States Code, is amended— in subsection (b)— in paragraph (8), by striking or at the end; in paragraph (9), by striking the period at the end and inserting ; or; and by adding at the end the following: to the Attorney General, in connection with a report submitted thereto under section 521 of the Controlled Substances Act. in subsection (c)— in paragraph (6), by striking or at the end; in paragraph (7), by striking the period at the end and inserting ; or; and by adding at the end the following: to the Attorney General, in connection with a report submitted thereto under section 521 of the Controlled Substances Act. Paragraph (7) of section 2702(b) of title 18, United States Code, is amended to read as follows: to a law enforcement agency if the contents— were inadvertently obtained by the service provider; and appear to pertain to the commission of a crime; 521.Reporting requirements of electronic communication service providers and remote computing services for certain controlled substances violations(a)DefinitionsIn this section—(1)the term electronic communication service has the meaning given that term in section 2510 of title 18, United States Code; (2) the term electronic mail address has the meaning given that term in section 3 of the CAN-SPAM Act of 2003 (15 U.S.C. 7702); (3)the term Internet has the meaning given that term in section 1101(d)(3) of the Internet Tax Freedom Act (47 U.S.C. 151 note);(4)the term provider means an electronic communication service provider or remote computing service;(5)the term remote computing service has the meaning given that term in section 2711 of title 18, United States Code; and(6)the term website means any collection of material placed in a computer server-based file archive so that it is publicly accessible, over the Internet, using hypertext transfer protocol or any successor protocol. (b) Duty To report (1) General duty In order to reduce the proliferation of the unlawful sale, distribution, or manufacture (as applicable) of counterfeit substances and certain controlled substances, a provider shall, as soon as reasonably possible after obtaining actual knowledge of any facts or circumstances described in paragraph (2), and in any event not later than 60 days after obtaining such knowledge, submit to the Attorney General a report containing— (A) the mailing address, telephone number, facsimile number, and electronic mailing address of, and individual point of contact for, such provider; (B) information described in subsection (c) concerning such facts or circumstances; and (C) for purposes of subsection (j), information indicating whether the facts or circumstances were discovered through content moderation conducted by a human or via a non-human method, including use of an algorithm, machine learning, or other means. (2) Facts or circumstances The facts or circumstances described in this paragraph are any facts or circumstances establishing that a crime is being or has already been committed involving— (A) creating, manufacturing, distributing, dispensing, or possession with intent to manufacture, distribute, or dispense— (i) fentanyl; or (ii) methamphetamine; (B) creating, manufacturing, distributing, dispensing, or possession with intent to manufacture, distribute, or dispense a counterfeit substance, including a counterfeit substance purporting to be a prescription drug; or (C) creating, manufacturing, distributing, dispensing, or possession with intent to manufacture, distribute, or dispense an actual or purported prescription pain medication or prescription stimulant by any individual or entity that is not authorized, which includes an individual or entity that falsely claims to be a practitioner. (3) Permitted actions based on reasonable belief In order to reduce the proliferation of the unlawful sale, distribution, or manufacture (as applicable) of counterfeit substances and certain controlled substances, if a provider has a reasonable belief that facts or circumstances described in paragraph (2) exist, the provider may submit to the Attorney General a report described in paragraph (1). (c)Contents of report(1)In generalTo the extent the information is within the custody or control of a provider, the facts or circumstances included in each report under subsection (b)(1)—(A)shall include, to the extent that it is applicable and reasonably available, information relating to the account involved in the commission of a crime described in subsection (b)(2), such as the name, address, electronic mail address, user or account identification, Internet Protocol address, uniform resource locator, screen names or monikers for the account used or any other accounts associated with the account user, or any other identifying information, including self-reported identifying information, but not including the contents of a wire communication or electronic communication, as those terms are defined in section 2510 of title 18, United States Code, except as provided in subparagraph (B) of this paragraph; and(B)may, at the sole discretion of the provider, include the information described in paragraph (2) of this subsection.(2)Other informationThe information referred to in paragraph (1)(B) is the following:(A)Historical referenceInformation relating to when and how a user, subscriber, or customer of a provider uploaded, transmitted, or received content relating to the report or when and how content relating to the report was reported to or discovered by the provider, including a date and time stamp and time zone.(B)Geographic location informationInformation relating to the geographic location of the involved individual or website, which may include the Internet Protocol address or verified address, or, if not reasonably available, at least one form of geographic identifying information, including area code or ZIP Code, provided by the user, subscriber, or customer, or stored or obtained by the provider, and any information as to whether a virtual private network was used.(C)Data relating to facts or circumstancesAny data, including symbols, photos, video, icons, or direct messages, relating to activity involving the facts or circumstances described in subsection (b)(2) or other content relating to the crime.(D)Complete communicationThe complete communication containing the information of the crime described in subsection (b)(2), including—(i)any data or information regarding the transmission of the communication; and(ii)any data or other digital files contained in, or attached to, the communication.(3)User, subscriber, or customer submitted reportsIn the case of a report under subsection (b)(3), the provider may, at its sole discretion, include in the report information submitted to the provider by a user, subscriber, or customer alleging facts or circumstances described in subsection (b)(2) if the provider, upon review, has a reasonable belief that the alleged facts or circumstances exist.(d)Handling of reportsUpon receipt of a report submitted under subsection (b), the Attorney General—(1)shall conduct a preliminary review of such report; and(2)after completing the preliminary review, shall—(A)conduct further investigation of the report, which may include making the report available to other Federal, State, or local law enforcement agencies involved in the investigation of crimes described in subsection (b)(2), if the Attorney General determines that the report facially contains sufficient information to warrant and permit further investigation; or(B)conclude that no further investigative steps are warranted or possible, or that insufficient evidence exists to make a determination, and close the report.(e)Attorney general responsibilities(1)In generalThe Attorney General shall enforce this section.(2)Designation of federal agenciesThe Attorney General may designate a Federal law enforcement agency or agencies to which the Attorney General may forward a report under subsection (d).(3)Data minimization requirementsThe Attorney General shall take reasonable measures to—(A)limit the storage of a report submitted under subsection (b) and its contents to the amount that is necessary to carry out the investigation of crimes described in subsection (b)(2); and(B)store a report submitted under subsection (b) and its contents only as long as is reasonably necessary to carry out an investigation of crimes described in subsection (b)(2) or make the report available to other agencies under subsection (d)(2)(A), after which time the report and its contents shall be deleted unless the preservation of a report has future evidentiary value. (f) Failure To comply with requirements (1) Criminal penalty (A) Offense It shall be unlawful for a provider to knowingly fail to submit a report required under subsection (b)(1). (B) Penalty A provider that violates subparagraph (A) shall be fined— (i) in the case of an initial violation, not more than $190,000; and (ii) in the case of any second or subsequent violation, not more than $380,000. (2) Civil penalty In addition to any other available civil or criminal penalty, a provider shall be liable to the United States Government for a civil penalty in an amount not less than $50,000 and not more than $100,000 if the provider knowingly submits a report under subsection (b) that— (A) contains materially false or fraudulent information; or (B) omits information described in subsection (c)(1)(A) that is reasonably available. (g)Protection of privacyNothing in this section shall be construed to—(1)require a provider to monitor any user, subscriber, or customer of that provider;(2)require a provider to monitor the content of any communication of any person described in paragraph (1);(3)require a provider to affirmatively search, screen, or scan for facts or circumstances described in subsection (b)(2);(4)permit actual knowledge to be proven based solely on a provider’s decision not to engage in additional verification or investigation to discover facts and circumstances that are not readily apparent, so long as the provider does not deliberately blind itself to those violations; or(5)prohibit a provider from using end-to-end encryption or require a provider to decrypt encrypted communications. (h)Conditions of disclosure of information contained within report(1)In generalExcept as provided in paragraph (2), a law enforcement agency that receives a report under subsection (d) shall not disclose any information contained in that report.(2)Permitted disclosures by law enforcementA law enforcement agency may disclose information in a report received under subsection (d)—(A)to an attorney for the government for use in the performance of the official duties of that attorney, including providing discovery to a defendant;(B)to such officers and employees of that law enforcement agency, as may be necessary in the performance of their investigative and recordkeeping functions;(C)to such other government personnel (including personnel of a State or subdivision of a State) as are determined to be necessary by an attorney for the government to assist the attorney in the performance of the official duties of the attorney in enforcing Federal criminal law;(D)if the report discloses an apparent violation of State criminal law, to an appropriate official of a State or subdivision of a State for the purpose of enforcing such State law;(E)to a defendant in a criminal case or the attorney for that defendant to the extent the information relates to a criminal charge pending against that defendant;(F)to a provider if necessary to facilitate response to legal process issued in connection to a criminal investigation, prosecution, or post-conviction remedy relating to that report;(G)as ordered by a court upon a showing of good cause and pursuant to any protective orders or other conditions that the court may impose; and(H)in order to facilitate the enforcement of the penalties authorized under subsection (f).(i)Preservation(1)In general(A)Request to preserve contents(i)In generalSubject to clause (ii), for the purposes of this section, a completed submission by a provider of a report to the Attorney General under subsection (b)(1) shall be treated as a request to preserve the contents provided in the report, and any data or other digital files that are reasonably accessible and may provide context or additional information about the reported material or person, for 90 days after the submission to the Attorney General.(ii)Limitations on extension of preservation period(I)Stored communications actThe Attorney General may not submit a request to a provider to continue preservation of the contents of a report or other data described in clause (i) under section 2703(f) of title 18, United States Code, beyond the required period of preservation under clause (i) of this subparagraph unless the Attorney General has an active or pending investigation involving the user, subscriber, or customer account at issue in the report.(II)Rule of constructionNothing in subclause (I) shall preclude another Federal, State, or local law enforcement agency from seeking continued preservation of the contents of a report or other data described in clause (i) under section 2703(f) of title 18, United States Code.(B)Notification to userA provider may not notify a user, subscriber, or customer of the provider of a preservation request described in subparagraph (A) unless—(i)the provider has notified the Attorney General of its intent to provide that notice; and(ii)45 business days have elapsed since the notification under clause (i).(2)Protection of preserved materialsA provider preserving materials under this section shall maintain the materials in a secure location and take appropriate steps to limit access to the materials by agents or employees of the provider to that access necessary to comply with the requirements of this subsection.(3)Authorities and duties not affectedNothing in this section shall be construed as replacing, amending, or otherwise interfering with the authorities and duties under section 2703 of title 18, United States Code.(4)Relation to reporting requirementSubmission of a report as required by subsection (b)(1) does not satisfy the obligations under this subsection.(j)Annual reportNot later than 1 year after the date of enactment of the Cooper Davis and Devin Norring Act, and annually thereafter, the Attorney General shall publish a report that includes, for the reporting period—(1)the total number of reports received from providers under subsection (b)(1);(2)the number of reports received under subsection (b)(1) disaggregated by—(A)the provider on whose electronic communication service or remote computing service the crime for which there are facts or circumstances occurred; and(B)the subsidiary of a provider, if any, on whose electronic communication service or remote computing service the crime for which there are facts or circumstances occurred;(3)the number of reports received under subsection (b)(1) that led to convictions in cases investigated by the Attorney General;(4)the number of reports received under subsection (b)(1) that lacked actionable information;(5)the number of reports received under subsection (b)(1) where the facts or circumstances of a crime were discovered through—(A)content moderation conducted by a human; or(B)a non-human method including use of an algorithm, machine learning, or other means;(6)the number of reports received under subsection (b)(1) that were made available to other law enforcement agencies, disaggregated by—(A)the number of reports made available to Federal law enforcement agencies;(B)the number of reports made available to State law enforcement agencies; and(C)the number of reports made available to local law enforcement agencies; and(7)the number of requests to providers to continue preservation of the contents of a report or other data described in subsection (i)(1)(A)(i) submitted by the Attorney General under section 2703(f) of title 18, United States Code.(k)Prohibition on submission of user, subscriber, customer, or anonymous reports by law enforcement(1)In generalNo Federal, Tribal, State, or local law enforcement officer acting in an official capacity may submit a report to a provider or arrange for another individual to submit a report to a provider on behalf of the officer under this section.(2)Remedy for violationNo part of the contents of a provider’s report made under subsection (b)(1) or (b)(3) and no evidence derived therefrom may be received in evidence in any trial, hearing, or other proceeding in or before any court, department, officer, agency, regulatory body, legislative committee, or other authority of the United States, a State, or a political subdivision thereof if that provider report resulted from an action prohibited by paragraph (1) of this subsection.(l)Exemption for providers of broadband internet access service and text messaging serviceSubsections (b) through (k) shall not apply to a provider of—(1)broadband internet access service, as that term is defined in section 8.1(b) of title 47, Code of Federal Regulations (or any successor regulation), insofar as the provider is acting as a provider of such service; or(2)text messaging service, as that term is defined in section 227(e)(8) of title 47, United States Code, insofar as the provider is acting as a provider of such service.. Sec. 521. Reporting requirements of electronic communication service providers and remote computing services for certain controlled substances violations.. (10)to the Attorney General, in connection with a report submitted thereto under section 521 of the Controlled Substances Act.; and (8)to the Attorney General, in connection with a report submitted thereto under section 521 of the Controlled Substances Act.. (7)to a law enforcement agency if the contents—(A)were inadvertently obtained by the service provider; and(B)appear to pertain to the commission of a crime;.

521. Reporting requirements of electronic communication service providers and remote computing services for certain controlled substances violations In this section— the term electronic communication service has the meaning given that term in section 2510 of title 18, United States Code; the term electronic mail address has the meaning given that term in section 3 of the CAN-SPAM Act of 2003 (15 U.S.C. 7702); the term Internet has the meaning given that term in section 1101(d)(3) of the Internet Tax Freedom Act (47 U.S.C. 151 note); the term provider means an electronic communication service provider or remote computing service; the term remote computing service has the meaning given that term in section 2711 of title 18, United States Code; and the term website means any collection of material placed in a computer server-based file archive so that it is publicly accessible, over the Internet, using hypertext transfer protocol or any successor protocol. In order to reduce the proliferation of the unlawful sale, distribution, or manufacture (as applicable) of counterfeit substances and certain controlled substances, a provider shall, as soon as reasonably possible after obtaining actual knowledge of any facts or circumstances described in paragraph (2), and in any event not later than 60 days after obtaining such knowledge, submit to the Attorney General a report containing— the mailing address, telephone number, facsimile number, and electronic mailing address of, and individual point of contact for, such provider; information described in subsection (c) concerning such facts or circumstances; and for purposes of subsection (j), information indicating whether the facts or circumstances were discovered through content moderation conducted by a human or via a non-human method, including use of an algorithm, machine learning, or other means. The facts or circumstances described in this paragraph are any facts or circumstances establishing that a crime is being or has already been committed involving— creating, manufacturing, distributing, dispensing, or possession with intent to manufacture, distribute, or dispense— fentanyl; or methamphetamine; creating, manufacturing, distributing, dispensing, or possession with intent to manufacture, distribute, or dispense a counterfeit substance, including a counterfeit substance purporting to be a prescription drug; or creating, manufacturing, distributing, dispensing, or possession with intent to manufacture, distribute, or dispense an actual or purported prescription pain medication or prescription stimulant by any individual or entity that is not authorized, which includes an individual or entity that falsely claims to be a practitioner. In order to reduce the proliferation of the unlawful sale, distribution, or manufacture (as applicable) of counterfeit substances and certain controlled substances, if a provider has a reasonable belief that facts or circumstances described in paragraph (2) exist, the provider may submit to the Attorney General a report described in paragraph (1). To the extent the information is within the custody or control of a provider, the facts or circumstances included in each report under subsection (b)(1)— shall include, to the extent that it is applicable and reasonably available, information relating to the account involved in the commission of a crime described in subsection (b)(2), such as the name, address, electronic mail address, user or account identification, Internet Protocol address, uniform resource locator, screen names or monikers for the account used or any other accounts associated with the account user, or any other identifying information, including self-reported identifying information, but not including the contents of a wire communication or electronic communication, as those terms are defined in section 2510 of title 18, United States Code, except as provided in subparagraph (B) of this paragraph; and may, at the sole discretion of the provider, include the information described in paragraph (2) of this subsection. The information referred to in paragraph (1)(B) is the following: Information relating to when and how a user, subscriber, or customer of a provider uploaded, transmitted, or received content relating to the report or when and how content relating to the report was reported to or discovered by the provider, including a date and time stamp and time zone. Information relating to the geographic location of the involved individual or website, which may include the Internet Protocol address or verified address, or, if not reasonably available, at least one form of geographic identifying information, including area code or ZIP Code, provided by the user, subscriber, or customer, or stored or obtained by the provider, and any information as to whether a virtual private network was used. Any data, including symbols, photos, video, icons, or direct messages, relating to activity involving the facts or circumstances described in subsection (b)(2) or other content relating to the crime. The complete communication containing the information of the crime described in subsection (b)(2), including— any data or information regarding the transmission of the communication; and any data or other digital files contained in, or attached to, the communication. In the case of a report under subsection (b)(3), the provider may, at its sole discretion, include in the report information submitted to the provider by a user, subscriber, or customer alleging facts or circumstances described in subsection (b)(2) if the provider, upon review, has a reasonable belief that the alleged facts or circumstances exist. Upon receipt of a report submitted under subsection (b), the Attorney General— shall conduct a preliminary review of such report; and after completing the preliminary review, shall— conduct further investigation of the report, which may include making the report available to other Federal, State, or local law enforcement agencies involved in the investigation of crimes described in subsection (b)(2), if the Attorney General determines that the report facially contains sufficient information to warrant and permit further investigation; or conclude that no further investigative steps are warranted or possible, or that insufficient evidence exists to make a determination, and close the report. The Attorney General shall enforce this section. The Attorney General may designate a Federal law enforcement agency or agencies to which the Attorney General may forward a report under subsection (d). The Attorney General shall take reasonable measures to— limit the storage of a report submitted under subsection (b) and its contents to the amount that is necessary to carry out the investigation of crimes described in subsection (b)(2); and store a report submitted under subsection (b) and its contents only as long as is reasonably necessary to carry out an investigation of crimes described in subsection (b)(2) or make the report available to other agencies under subsection (d)(2)(A), after which time the report and its contents shall be deleted unless the preservation of a report has future evidentiary value. It shall be unlawful for a provider to knowingly fail to submit a report required under subsection (b)(1). A provider that violates subparagraph (A) shall be fined— in the case of an initial violation, not more than $190,000; and in the case of any second or subsequent violation, not more than $380,000. In addition to any other available civil or criminal penalty, a provider shall be liable to the United States Government for a civil penalty in an amount not less than $50,000 and not more than $100,000 if the provider knowingly submits a report under subsection (b) that— contains materially false or fraudulent information; or omits information described in subsection (c)(1)(A) that is reasonably available. Nothing in this section shall be construed to— require a provider to monitor any user, subscriber, or customer of that provider; require a provider to monitor the content of any communication of any person described in paragraph (1); require a provider to affirmatively search, screen, or scan for facts or circumstances described in subsection (b)(2); permit actual knowledge to be proven based solely on a provider’s decision not to engage in additional verification or investigation to discover facts and circumstances that are not readily apparent, so long as the provider does not deliberately blind itself to those violations; or prohibit a provider from using end-to-end encryption or require a provider to decrypt encrypted communications. Except as provided in paragraph (2), a law enforcement agency that receives a report under subsection (d) shall not disclose any information contained in that report. A law enforcement agency may disclose information in a report received under subsection (d)— to an attorney for the government for use in the performance of the official duties of that attorney, including providing discovery to a defendant; to such officers and employees of that law enforcement agency, as may be necessary in the performance of their investigative and recordkeeping functions; to such other government personnel (including personnel of a State or subdivision of a State) as are determined to be necessary by an attorney for the government to assist the attorney in the performance of the official duties of the attorney in enforcing Federal criminal law; if the report discloses an apparent violation of State criminal law, to an appropriate official of a State or subdivision of a State for the purpose of enforcing such State law; to a defendant in a criminal case or the attorney for that defendant to the extent the information relates to a criminal charge pending against that defendant; to a provider if necessary to facilitate response to legal process issued in connection to a criminal investigation, prosecution, or post-conviction remedy relating to that report; as ordered by a court upon a showing of good cause and pursuant to any protective orders or other conditions that the court may impose; and in order to facilitate the enforcement of the penalties authorized under subsection (f). Subject to clause (ii), for the purposes of this section, a completed submission by a provider of a report to the Attorney General under subsection (b)(1) shall be treated as a request to preserve the contents provided in the report, and any data or other digital files that are reasonably accessible and may provide context or additional information about the reported material or person, for 90 days after the submission to the Attorney General. The Attorney General may not submit a request to a provider to continue preservation of the contents of a report or other data described in clause (i) under section 2703(f) of title 18, United States Code, beyond the required period of preservation under clause (i) of this subparagraph unless the Attorney General has an active or pending investigation involving the user, subscriber, or customer account at issue in the report. Nothing in subclause (I) shall preclude another Federal, State, or local law enforcement agency from seeking continued preservation of the contents of a report or other data described in clause (i) under section 2703(f) of title 18, United States Code. A provider may not notify a user, subscriber, or customer of the provider of a preservation request described in subparagraph (A) unless— the provider has notified the Attorney General of its intent to provide that notice; and 45 business days have elapsed since the notification under clause (i). A provider preserving materials under this section shall maintain the materials in a secure location and take appropriate steps to limit access to the materials by agents or employees of the provider to that access necessary to comply with the requirements of this subsection. Nothing in this section shall be construed as replacing, amending, or otherwise interfering with the authorities and duties under section 2703 of title 18, United States Code. Submission of a report as required by subsection (b)(1) does not satisfy the obligations under this subsection. Not later than 1 year after the date of enactment of the Cooper Davis and Devin Norring Act, and annually thereafter, the Attorney General shall publish a report that includes, for the reporting period— the total number of reports received from providers under subsection (b)(1); the number of reports received under subsection (b)(1) disaggregated by— the provider on whose electronic communication service or remote computing service the crime for which there are facts or circumstances occurred; and the subsidiary of a provider, if any, on whose electronic communication service or remote computing service the crime for which there are facts or circumstances occurred; the number of reports received under subsection (b)(1) that led to convictions in cases investigated by the Attorney General; the number of reports received under subsection (b)(1) that lacked actionable information; the number of reports received under subsection (b)(1) where the facts or circumstances of a crime were discovered through— content moderation conducted by a human; or a non-human method including use of an algorithm, machine learning, or other means; the number of reports received under subsection (b)(1) that were made available to other law enforcement agencies, disaggregated by— the number of reports made available to Federal law enforcement agencies; the number of reports made available to State law enforcement agencies; and the number of reports made available to local law enforcement agencies; and the number of requests to providers to continue preservation of the contents of a report or other data described in subsection (i)(1)(A)(i) submitted by the Attorney General under section 2703(f) of title 18, United States Code. No Federal, Tribal, State, or local law enforcement officer acting in an official capacity may submit a report to a provider or arrange for another individual to submit a report to a provider on behalf of the officer under this section. No part of the contents of a provider’s report made under subsection (b)(1) or (b)(3) and no evidence derived therefrom may be received in evidence in any trial, hearing, or other proceeding in or before any court, department, officer, agency, regulatory body, legislative committee, or other authority of the United States, a State, or a political subdivision thereof if that provider report resulted from an action prohibited by paragraph (1) of this subsection. Subsections (b) through (k) shall not apply to a provider of— broadband internet access service, as that term is defined in section 8.1(b) of title 47, Code of Federal Regulations (or any successor regulation), insofar as the provider is acting as a provider of such service; or text messaging service, as that term is defined in section 227(e)(8) of title 47, United States Code, insofar as the provider is acting as a provider of such service.