Document ID: ./input/supremecourt_opinions/opinions/20pdf/19-783_k53l.pdf
Page Number: 6

2 

VAN BUREN v. UNITED STATES 

Opinion of the Court 

computers to schools, offices, and homes across the Nation. 
But as the public and private sectors harnessed the power
of  computing  for  improvement  and  innovation,  so-called 
hackers hatched ways  to coopt computers for illegal ends. 
After  a  series  of  highly  publicized  hackings  captured  the
public’s attention, it became clear that traditional theft and
trespass  statutes  were  ill  suited  to  address  cybercrimes
that did not deprive computer owners of property in the tra-
ditional sense.  See Kerr, Cybercrime’s Scope: Interpreting
“Access” and “Authorization” in Computer Misuse Statutes, 
78 N. Y. U. L. Rev. 1596, 1605–1613 (2003). 

Congress, following the lead of several States, responded 
by enacting the first federal computer-crime statute as part
of the Comprehensive Crime Control Act of 1984.  §2102(a),
98 Stat. 2190–2192.  A few years later, Congress passed the
CFAA, which included the provisions at issue in this case. 
The  Act  subjects  to  criminal  liability  anyone  who  “inten-
tionally  accesses  a  computer  without  authorization  or  ex-
ceeds authorized access,” and thereby obtains computer in-
formation.  18  U. S. C.  §1030(a)(2).    It  defines  the  term 
“exceeds authorized access” to mean “to access a computer
with authorization and to use such access to obtain or alter 
information in the computer that the accesser is not enti-
tled so to obtain or alter.”  §1030(e)(6). 

Initially, subsection (a)(2)’s prohibition barred accessing 
only certain financial information.  It has since expanded to 
cover any information from any computer “used in or affect-
ing  interstate  or  foreign  commerce  or  communication.”
§1030(e)(2)(B).  As a result, the prohibition now applies—at 
a  minimum—to  all  information  from  all  computers  that 
connect to the Internet.  §§1030(a)(2)(C), (e)(2)(B). 

Those who violate §1030(a)(2) face penalties ranging from
fines and misdemeanor sentences to imprisonment for up to
10 years.  §1030(c)(2).  They also risk civil liability under 
the  CFAA’s  private  cause  of  action,  which  allows  persons 
suffering “damage” or “loss” from CFAA violations to sue for