II 

112TH CONGRESS 

2D SESSION S. 3569 

To improve the enforcement of criminal and civil law with respect to cloud 

computing, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

SEPTEMBER 19, 2012 

Ms. KLOBUCHAR (for herself and Mr. HOEVEN) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To improve the enforcement of criminal and civil law with 

respect to cloud computing, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cloud Computing Act 

5 of 2012’’. 

6 SEC. 2. UNLAWFUL ACCESS TO CLOUD COMPUTING SERV7 ICES. 

8 (a) IN GENERAL.—Section 1030 of title 18, United 

9 States Code, is amended by adding at the end the fol10 lowing: 


srobinson on DSK4SPTVN1PROD with BILLS
2 

•S 3569 IS

1 ‘‘(k) For purposes of an offense described in para2 graph (2)(C), (4), or (5) of subsection (a) or an attempt 

3 or conspiracy to commit such an offense, if the protected 

4 computer is part of a cloud computing service, each in5 stance of unauthorized access of a cloud computing ac6 count, access in excess of authorization of a cloud com7 puting account, or attempt or conspiracy to access a cloud 

8 computing account without authorization or in excess of 

9 authorization shall constitute a separate offense.’’. 

10 (b) DEFINITIONS.—Section 1030(e) of title 18, 

11 United States Code, is amended— 

12 (1) in paragraph (11), by striking ‘‘and’’ at the 

13 end; 

14 (2) in paragraph (12), by striking the period at 

15 the end and inserting a semicolon; and 

16 (3) by adding at the end the following: 

17 ‘‘(13) the term ‘cloud computing account’ 

18 means information stored on a cloud computing 

19 service that requires a password or similar informa20 tion to access and is attributable to an individual, 

21 which may include allowing a customer of the cloud 

22 computing service to have multiple accounts; and 

23 ‘‘(14) the term ‘cloud computing service’ means 

24 a service that enables convenient, on-demand net25 work access to a shared pool of configurable comVerDate Mar 15 2010 23:25 Sep 22, 2012 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S3569.IS S3569

srobinson on DSK4SPTVN1PROD with BILLS
3 

•S 3569 IS

1 puting resources (including networks, servers, stor2 age, applications, and services) that can be rapidly 

3 provisioned and released with minimal management 

4 effort or interaction by the provider of the service.’’. 

5 SEC. 3. PRESUMED LOSSES. 

6 Section 1030 of title 18, United States Code, as 

7 amended by section 2(a), is amended by adding at the end 

8 the following: 

9 ‘‘(l) If an offense under this section involves a pro10 tected computer that is part of a cloud computing service, 

11 the value of the loss of the use of the protected computer 

12 for purposes of subsection (a)(4), the value of the informa13 tion obtained for purposes of subsection (c)(2)(B)(iii), and 

14 the value of the aggregated loss for purposes of subsection 

15 (c)(4)(A)(i)(I) shall be the greater of— 

16 ‘‘(1) the value of the loss of use, information, 

17 or aggregated loss to 1 or more persons; or 

18 ‘‘(2) the product obtained by multiplying the 

19 number of cloud computing accounts accessed by 

20 $500.’’. 

21 SEC. 4. INTERACTION WITH INTERNATIONAL FORA TO AD22 VANCE INTERNATIONAL INTEROPERABILITY 

23 WITH LAW AND POLICIES OF UNITED STATES. 

24 The Secretary of State shall work with other inter25 national fora, such as the Organization for Economic CoVerDate Mar 15 2010 23:25 Sep 22, 2012 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S3569.IS S3569

srobinson on DSK4SPTVN1PROD with BILLS
4 

•S 3569 IS

1 operation and Development, to advance the aims of ensur2 ing interoperability between the provisions of this Act, the 

3 amendments made by this Act, and other laws and policies 

4 of the United States and foreign countries, including in 

5 consultations between the United States and the European 

6 Union. 

7 SEC. 5. ANNUAL STUDY AND REPORT ON INTERNATIONAL 

8 COOPERATION REGARDING DATA PRIVACY, 

9 RETENTION, AND SECURITY. 

10 (a) IN GENERAL.—Not later than 180 days after the 

11 date of the enactment of this Act and not less frequently 

12 than once each year thereafter for 4 years, the Secretary 

13 of State shall— 

14 (1) conduct a study on international coopera15 tion regarding data privacy, retention, and security; 

16 and 

17 (2) submit to Congress a report on the findings 

18 of the Secretary with respect to the most recent 

19 study carried out under paragraph (1) and the ac20 tivities of the Secretary under section 4. 

21 (b) MATTERS STUDIED.—Each study conducted 

22 under subsection (a)(1) shall include development of rec23 ommendations for best practices, treaties, common policy 

24 frameworks, mutual recognition agreements, the creation 

25 of hybrid public-private authorities, codes of conduct, or 


srobinson on DSK4SPTVN1PROD with BILLS
5 

•S 3569 IS

1 other guidance the Secretary of State considers necessary 

2 to promote the development of laws and policies in foreign 

3 countries that are interoperable with and that will rein4 force the effectiveness of— 

5 (1) the provisions of this Act and the amend6 ments made by this Act; and 

7 (2) policies relating to data privacy, data reten8 tion, security of data, and assertions of jurisdiction 

9 over data, including with respect to law enforcement 

10 access to data. 

11 (c) INTERAGENCY COORDINATION.—In conducting 

12 the studies required by subsection (a)(1), the Secretary 

13 of State shall consult with the heads of relevant agencies, 

14 such as the following: 

15 (1) The National Economic Council. 

16 (2) The Attorney General. 

17 (3) The Secretary of Commerce. 

18 (4) The Federal Trade Commission. 

19 (5) The Secretary of Homeland Security. 

20 (6) The United States Trade Representative. 

21 SEC. 6. ANNUAL FEDERAL INFORMATION TECHNOLOGY 

22 AND CLOUD COMPUTING PROCUREMENT 

23 FORECAST. 

24 (a) CLOUD COMPUTING SERVICE DEFINED.—In this 

25 section, the term ‘‘cloud computing service’’ has the meanVerDate Mar 15 2010 23:25 Sep 22, 2012 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S3569.IS S3569

srobinson on DSK4SPTVN1PROD with BILLS
6 

•S 3569 IS

1 ing given the term by the Under Secretary of Commerce 

2 for Standards and Technology. 

3 (b) FORECAST REQUIRED.—Not later than 180 days 

4 after the date of the enactment of this Act and not less 

5 frequently than once each year thereafter for 4 years, the 

6 head of each Federal agency described in section 901(b) 

7 of title 31, United States Code, shall, consistent with 

8 Cloud First policy outlined in the document of the Office 

9 of Management and Budget entitled ‘‘Federal Cloud Com10 puting Strategy’’ and dated February 8, 2011, submit to 

11 the Administrator of the Office of Electronic Government 

12 and Information Technology of the Office of Management 

13 and Budget a 3-year forecast of the plans of the agency 

14 relating to the procurement of cloud computing services 

15 and support relating to such services. 

16 (c) PUBLICATION.—The Administrator shall make 

17 each 3-year forecast submitted under subsection (b) avail18 able to the public via an Internet website. 

Æ 


srobinson on DSK4SPTVN1PROD with BILLS