Van Buren v. United States

Nathan Van Buren was a police sergeant in Cumming, Georgia. In 2015, facing financial difficulties, he solicited money from a local man, Andrew Albo. Albo reported this to the FBI, which set up a sting operation. An undercover officer asked Van Buren to run a license plate search in exchange for $6,000. Van Buren used his valid police credentials to access the law enforcement database, violating department policy that restricted such searches to official purposes. He was convicted of felony computer fraud under the Computer Fraud and Abuse Act (CFAA) and sentenced to 18 months in prison. The Eleventh Circuit affirmed the conviction, and the Supreme Court granted certiorari to resolve a circuit split over the meaning of "exceeds authorized access."

The Supreme Court reversed the conviction in a 6-3 decision on June 3, 2021. The Court held that an individual "exceeds authorized access" only when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off-limits to him. The Court concluded that the CFAA does not cover those who have improper motives for obtaining information that is otherwise available to them. Justice Amy Coney Barrett wrote the majority opinion, joined by Justices Breyer, Sotomayor, Kagan, Gorsuch, and Kavanaugh. Justice Clarence Thomas dissented, joined by Chief Justice Roberts and Justice Alito.

Whether an individual "exceeds authorized access" under the Computer Fraud and Abuse Act (CFAA) when the individual is authorized to access information on a computer for a specific purpose but accesses that information for an impermissible purpose.

The decision significantly narrowed the scope of the CFAA, which had been criticized as overly broad. It resolved a circuit split and clarified that violations of workplace computer-use policies or website terms of service do not automatically constitute federal crimes. The ruling was praised by digital privacy activists and legal scholars who argued that the government's broad interpretation would criminalize commonplace computer activity. However, the decision also left gaps in protection against malicious actors who misuse their authorized access to computers and digital networks. The case has had broad implications for employers protecting sensitive data and for prosecutors pursuing hacking and computer fraud cases.