Court decision · 3 June 2021
Van Buren v. United States
593 U.S. 374 (2021) · Supreme Court of the United States
What it means for your code
CFAA exposure turns on technical access barriers; enforce authorisation in code, not just in your terms of service.
What happened
A police officer used his authorised database access for an improper purpose and was prosecuted under the CFAA.
What was decided
An individual 'exceeds authorized access' under the CFAA only by accessing areas of a computer (files, folders, databases) that are off-limits to them, not by misusing information they are entitled to access.
The legal test applied
- 'Exceeds authorized access' covers entering areas of a computer that are off-limits, not misusing information one may access
What would have changed the outcome
- Circumventing technical barriers such as logins or IP blocks can still be access 'without authorization'
Read the decision at the source
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.