Van Buren v. United States

Nathan Van Buren, a former Georgia police officer, was convicted under the Computer Fraud and Abuse Act (CFAA) for using his patrol-car computer to run a license plate search in exchange for money during an FBI sting operation. Although he had authorized access to the law enforcement database, the government argued his improper purpose for the search constituted “exceeding authorized access.” The Supreme Court granted certiorari to resolve a circuit split. In a 6-3 decision authored by Justice Barrett, the Court held that the CFAA’s “exceeds authorized access” clause does not cover individuals who have permission to access a computer system but misuse that access for an improper purpose. The ruling reversed Van Buren’s conviction and remanded the case.

The Supreme Court reversed the Eleventh Circuit’s judgment. It held that Van Buren did not violate the CFAA because the statutory phrase “exceeds authorized access” refers to obtaining information from areas of a computer system that are off-limits to the user, not to accessing permitted areas for an improper motive.

Whether a person with authorized access to a computer system violates the Computer Fraud and Abuse Act by accessing that system for an improper purpose, thus “exceeding authorized access.”

The decision significantly narrowed the scope of the CFAA, protecting millions of employees and internet users from potential criminal liability for violating workplace computer-use policies or website terms of service. It resolved a long-standing circuit split and established a clear, narrow interpretation of “exceeds authorized access,” setting a major precedent for cybercrime prosecutions. The ruling was widely praised for preventing over-criminalization of routine online behavior while still allowing prosecution of true hacking.