![handle is hein.crs/govedwf0001 and id is 1 raw text is: Congressional ______
SResearch Service
Van Buren v. United States: Supreme Court
Holds Accessing Information on a Computer
for Unauthorized Purposes Not Federal Crime
July 1, 2021
On June 3, 2021, the United States Supreme Court issued its opinion in Van Buren v. United States,
holding that an individual does not violate the Computer Fraud and Abuse Act (CFAA) if he is authorized
to obtain information on a computer for specific purposes only, and he then accesses that information for
other unauthorized purposes. Rather, in a 6-3 opinion authored by Justice Barrett, the Court determined
that in order to violate the CFAA, an individual must access an area of a computer or information on a
computer that is completely off limits to him, as opposed to accessing a computer or information that he
is entitled to use in at least some circumstances. In so holding, the Court appears to have resolved an issue
that has divided lower courts-whether obtaining information for an improper purpose is unlawful under
the CFAA. Given the potentially wide-reaching implications of Van Buren, which marks the Court's first
significant foray into a statute that has been described as the nation's predominant anti-hacking law, this
Sidebar provides an overview of the Court's holding and analysis. The Sidebar concludes with a summary
of some possible implications stemming from Van Buren, as well as various issues for congressional
consideration. A summary of relevant legal background, as well as the parties' arguments in Van Buren,
may be found in a previous CRS product: CRS Legal Sidebar LSB 10423, From Clickwrap to RAP Sheet:
Criminal Liability Under the Computer Fraud and Abuse Act for Terms of Service Violations, by Peter G.
Berns.
Holding and Analysis
Van Buren stems from the conviction of former police sergeant Nathan Van Buren for violating, among
other things, 18 U.S.C. @ 1030(a)(2)-a provision of the CFAA which makes it a crime to intentionally
access a computer without authorization or to exceed authorized access and obtain information from a
financial institution, the federal government, or any protected computer (any computer connected to the
internet). Another subsection of the CFAA-@ 1030(e)(6)-defines exceeds authorized access as
access[ing] a computer with authorization and ... us[ing] such access to obtain or alter information in
the computer that the accesser is not entitled so to obtain or alter. Van Buren used a law enforcement
database, which he was authorized to use only for law enforcement purposes, to search for license plate
Congressional Research Service
https://crsreports.congress.gov
LSB10616
CRS Legal Sidebar
Prepared for Members and
Committees of Congress](ViewImageLocal?handle=hein.crs/govedwf0001&div=1&collection=&method=preview&ext=.png&size=3)
What Is HeinOnline?
Contact us for annual subscription options:
Already a HeinOnline Subscriber?
profiles profiles most
Contact us for annual subscription options:
Already a HeinOnline Subscriber?
profiles profiles most
Contact us for annual subscription options:
Already a HeinOnline Subscriber?
profiles profiles most