## Facts

- Nathan Van Buren, a Georgia police sergeant, used his patrol-car computer and valid credentials to access a law-enforcement database.
- He ran a license-plate search in exchange for money as part of an FBI sting operation.
- Department policy allowed database access only for law-enforcement purposes; his query was for personal gain and violated that policy.
- A federal jury convicted Van Buren of, among other offenses, a felony violation of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030(a)(2).
- The Eleventh Circuit affirmed, applying a reading of “exceeds authorized access” that treats access for an improper purpose as a CFAA violation.

## Issues

1. Whether a person who is authorized to obtain certain computer information violates the CFAA by obtaining the same information for an improper or prohibited purpose.
2. Whether “exceeds authorized access” in 18 U.S.C. § 1030(e)(6) turns on purpose-based limits (use policies) or on access-based limits (off-limits files, folders, or databases).

## Decision

- The Supreme Court reversed the Eleventh Circuit in a 6–3 decision.
- The Court held that a user “exceeds authorized access” only when authorized access is used to obtain information from computer areas that are off limits to that user.
- Because Van Buren accessed information in a database he was permitted to access (even if only for certain job-related reasons), he did not “exceed authorized access” under the CFAA.
- The Court vacated the CFAA conviction premised on the broader, purpose-based interpretation.

## Legal Principles

- Under 18 U.S.C. § 1030(e)(6), “exceeds authorized access” is limited to obtaining information from specific computer areas (e.g., files, folders, databases) that the user lacks permission to access.
- Misusing information that one is otherwise entitled to obtain—such as violating workplace policies, terms of service, or purpose restrictions—does not fall within the CFAA’s “exceeds authorized access” clause.
- The statutory term “so” in “not entitled so to obtain” links entitlement to the manner of obtaining information (where in the system the user may go), not the user’s purpose.
- Reading the CFAA to criminalize policy or terms-of-use violations would extend federal criminal liability to common computer activity, a result inconsistent with the statute’s text and structure.

## Conclusion

The Court interpreted the CFAA’s “exceeds authorized access” provision to cover boundary-crossing into off-limits parts of a computer system, not purpose-based misuse of information that an authorized user is allowed to access.


Van Buren v. United States, 593 U.S. 374 (2021)