Document ID: ./input/supremecourt_opinions/opinions/20pdf/19-783_k53l.pdf
Page Number: 3.0

Cite as:  593 U. S. ____ (2021) 

3 

Syllabus 

equate “exceed[ing] authorized access” with the act of entering a part
of the system to which a computer user lacks access privileges.  Pp. 11– 
12. 

(b) The  statute’s  structure  further  cuts  against  the  Government’s 
position.  Subsection (a)(2) specifies two distinct ways of obtaining in-
formation unlawfully—first, when an individual “accesses a computer
without  authorization,”  §1030(a)(2),  and  second,  when  an  individual 
“exceeds authorized access” by accessing a computer “with authoriza-
tion” and then obtaining information he is “not entitled so to obtain,” 
§§1030(a)(2), (e)(6).  Van Buren contends that the “without authoriza-
tion”  clause  protects  computers  themselves  from  outside  hackers, 
while the “exceeds authorized access” clause provides complementary 
protection  for  certain  information  within  computers  by  targeting  so-
called inside hackers.  Under Van Buren’s reading, liability under both 
clauses stems from a gates-up-or-down inquiry—one either can or can-
not access a computer system, and one either can or cannot access cer-
tain areas within the system.  This treats the clauses consistently and
aligns with the computer-context understanding of access as entry.  By
contrast, the Government proposes to read the first phrase “without 
authorization”  as  a  gates-up-or-down  inquiry  and  the  second  phrase 
“exceeds  authorized  access”  as  dependent  on  the  circumstances—a 
reading inconsistent with subsection (a)(2)’s design and structure.  The 
Government’s reading leaves unanswered why the statute would pro-
hibit accessing computer information, but not the computer itself, for 
an improper purpose.

Another  structural  problem  for  the  Government:  §1030(a)(2)  also
gives rise to civil liability, §1030(g), with the statute defining “damage”
and  “loss”  to  specify  what  a  plaintiff  in  a  civil  suit  can  recover. 
§§1030(e)(8),  (11).    Both  terms  focus  on  technological  harms  to  com-
puter data or systems.  Such provisions make sense in a scheme aimed
at avoiding the ordinary consequences of hacking but are ill fitted to 
remediating “misuse” of sensitive information that employees permis-
sibly access using their computers.  Pp. 12–16.

(c) The  Government’s  claims  that  precedent  and  statutory  history
support its interpretation are easily dispatched.  This Court’s decision 
in Musacchio v. United States, 577 U. S. 237, did not address the issue 
here, and the Court is not bound to follow any dicta in the case.  As for 
statutory history, the Government claims that the original 1984 Act’s
precursor to the “exceeds authorized access” language—which covered
any person who, “having accessed a computer with authorization, uses
the opportunity such access provides for purposes to which such au-
thorization does not extend”—supports its reading.  But that Congress
removed any reference to “purpose” in the CFAA cuts against reading
the statute to cover purpose-based limitations.  Pp. 16–17.