Plain-English summary
Court limits computer-hacking law: accessing authorized data for improper reasons is not always a federal crime
The Supreme Court in Van Buren v. United States held that the Computer Fraud and Abuse Act (CFAA) does not criminalize every use of authorized access for an improper purpose. The decision narrows the statute to conduct where a person accesses parts of a computer system that are off-limits to them.
Why this matters
The ruling prevents the government from using the CFAA to turn many ordinary policy violations, terms-of-service breaches, or improper uses of workplace databases into federal crimes. It narrows prosecutors' reach and provides clearer guidance to employees, users, and website visitors about when computer-use problems are criminal.
Who may feel it
- Employees and contractors who access workplace computer systems
- Law enforcement officers and government workers with database access
- Website users and account holders governed by terms of service
- Businesses and IT administrators who set access controls
- Prosecutors and defense attorneys handling computer-crime cases
Key questions
- Does "exceeds authorized access" in the CFAA cover someone who has permission to access data but uses it for an improper purpose?