Document ID: ./input/supremecourt_opinions/opinions/20pdf/19-783_k53l.pdf
Page Number: 18

14 

VAN BUREN v. UNITED STATES 

Opinion of the Court 

reading both clauses to adopt a gates-up-or-down approach
aligns  with  the  computer-context  understanding  of  access 
as entry.  See supra, at 11–12.9 

By contrast, the Government’s reading of the “exceeds au-
thorized  access”  clause  creates  “inconsistenc[ies]  with  the
design  and  structure”  of  subsection  (a)(2).  University  of 
Tex. Southwestern Medical Center v. Nassar, 570 U. S. 338, 
353  (2013).    As  discussed,  the  Government  reads  the  “ex-
ceeds  authorized  access”  clause  to  incorporate  purpose-
based limits contained in contracts and workplace policies. 
Yet  the  Government  does  not  read  such  limits  into  the 
threshold  question  whether  someone  uses  a  computer 
“without  authorization”—even  though  similar  purpose  re-
strictions,  like  a  rule  against  personal  use,  often  govern 
one’s right to access a computer in the first place.  See, e.g., 
Royal Truck & Trailer Sales & Serv., Inc. v. Kraft, 974 F. 3d 
756,  757  (CA6  2020).  Thus,  the  Government  proposes  to 
read the first phrase “without authorization” as a gates-up-
or-down inquiry and the second phrase “exceeds authorized 
access” as one that depends on the circumstances.  The Gov-
ernment  does  not  explain  why  the  statute  would  prohibit 

—————— 

9 Van  Buren’s gates-up-or-down  reading  also  aligns  with  the  CFAA’s
prohibition on password trafficking.  See Tr. of Oral Arg. 33.  Enacted 
alongside  the  “exceeds  authorized  access”  definition  in  1986,  the  pass-
word-trafficking provision bars the sale of “any password or similar in-
formation through which a computer may be accessed without authori-
zation.”  §1030(a)(6).  The provision thus contemplates a “specific type of 
authorization—that is, authentication,” which turns on whether a user’s 
credentials  allow  him  to  proceed  past  a  computer’s  access  gate,  rather 
than on other, scope-based restrictions.  Bellia, A Code-Based Approach 
to Unauthorized Access Under the Computer Fraud and Abuse Act, 84
Geo. Wash. L. Rev. 1442, 1470 (2016); cf. A Dictionary of Computing, at
30 (defining “authorization” as a “process by which users, having com-
pleted an . . . authentication stage, gain or are denied access to particular
resources based on their entitlement”).