Document ID: ./input/supremecourt_opinions/opinions/20pdf/19-783_k53l.pdf
Page Number: 17

Cite as:  593 U. S. ____ (2021) 

13 

Opinion of the Court 

ways  of  obtaining  information  unlawfully.  First,  an  indi-
vidual violates the provision when he “accesses a computer
without authorization.”  §1030(a)(2).  Second, an individual 
violates the provision when he “exceeds authorized access” 
by accessing a computer “with authorization” and then ob-
taining  information  he  is  “not  entitled  so  to  obtain.” 
§§1030(a)(2), (e)(6).  Van Buren’s reading places the provi-
sion’s  parts  “into  an  harmonious  whole.”    Roberts  v.  Sea-
Land Services, Inc., 566 U. S. 93, 100 (2012) (internal quo-
tation marks omitted).  The Government’s does not. 

Start  with  Van  Buren’s  view.    The  “without  authoriza-
tion” clause, Van Buren contends, protects computers them-
selves  by  targeting  so-called  outside  hackers—those  who 
“acces[s] a computer without any permission at all.”  LVRC 
Holdings LLC v. Brekka, 581 F. 3d 1127, 1133 (CA9 2009); 
see also Pulte Homes, Inc. v. Laborers’ Int’l Union of North 
Am., 648 F. 3d 295, 304 (CA6 2011).  Van Buren reads the 
“exceeds  authorized  access”  clause  to  provide  complemen-
tary protection for certain information within computers.  It 
does  so,  Van  Buren  asserts,  by  targeting  so-called  inside 
hackers—those who access a computer with permission, but 
then  “ ‘exceed’  the  parameters  of  authorized  access  by  en-
tering an area of the computer to which [that] authorization 
does not extend.”  United States v. Valle, 807 F. 3d 508, 524 
(CA2 2015).

Van Buren’s account of subsection (a)(2) makes sense of
the  statutory  structure  because  it  treats  the  “without  au-
thorization”  and  “exceeds  authorized  access”  clauses  con-
sistently.  Under Van Buren’s reading, liability under both 
clauses stems from a gates-up-or-down inquiry—one either 
can or cannot access a computer system, and one either can
or  cannot  access  certain  areas  within  the  system.8    And  
—————— 

8 For present purposes, we need not address whether this inquiry turns
only on technological (or “code-based”) limitations on access, or instead
also looks to limits contained in contracts or policies.  Cf. Brief for Orin 
Kerr as Amicus Curiae 7 (urging adoption of code-based approach).