Document ID: ./input/supremecourt_opinions/opinions/20pdf/19-783_k53l.pdf
Page Number: 24.0

20 

VAN BUREN v. UNITED STATES 

Opinion of the Court 

two  can  be  thin  on  the  Government’s  reading.  Because 
purpose-based limits on access are often designed with an 
eye  toward  information  misuse,  they  can  be  expressed  as
either  access  or  use  restrictions.    For  example,  one  police 
department  might  prohibit  using  a  confidential  database
for a non-law-enforcement purpose (an access restriction),
while  another  might  prohibit  using  information  from  the 
database  for  a  non-law-enforcement  purpose  (a  use  re-
striction).  Conduct like Van Buren’s can be characterized 
either way, and an employer might not see much difference 
between the two.  On the Government’s reading, however,
the  conduct  would  violate  the  CFAA  only  if  the  employer 
phrased the policy as an access restriction.  An interpreta-
tion that stakes so much on a fine distinction controlled by 
the drafting practices of private parties is hard to sell as the
most plausible. 

IV 

In sum, an individual “exceeds authorized access” when 
he accesses a computer with authorization but then obtains 
information  located  in  particular  areas  of  the  computer—
such  as  files,  folders,  or  databases—that  are  off  limits  to 
him.  The parties agree that Van  Buren accessed the law 
enforcement database system with authorization.  The only
question is whether Van Buren could use the system to re-
trieve license-plate information.  Both sides agree that he 
could.  Van Buren accordingly did not “excee[d] authorized 
access” to the database, as the CFAA defines that phrase, 
even though he obtained information from the database for
an  improper  purpose.  We  therefore  reverse  the  contrary
judgment of the Eleventh Circuit and remand the case for 
further proceedings consistent with this opinion. 

It is so ordered.