Document ID: ./input/supremecourt_opinions/opinions/20pdf/19-783_k53l.pdf
Page Number: 1

(Slip Opinion) 

OCTOBER  TERM,  2020 

1 

Syllabus 

NOTE:  Where  it  is  feasible,  a  syllabus  (headnote)  will  be  released,  as  is 
being  done  in  connection  with  this  case,  at  the  time  the  opinion  is  issued. 
The  syllabus  constitutes  no  part  of  the  opinion  of  the  Court  but  has  been 
prepared  by  the  Reporter  of  Decisions  for  the  convenience  of  the  reader. 
See United States v. Detroit Timber & Lumber Co., 200 U. S. 321, 337. 

SUPREME COURT OF THE UNITED STATES 

Syllabus 

VAN BUREN v. UNITED STATES 

CERTIORARI TO THE UNITED STATES COURT OF APPEALS FOR 
THE ELEVENTH CIRCUIT 

No. 19–783.  Argued November 30, 2020—Decided June 3, 2021 

Former Georgia police sergeant Nathan Van Buren used his patrol-car
computer to access a law enforcement database to retrieve information
about a particular license plate number in exchange for money.  Alt-
hough  Van  Buren  used  his  own,  valid  credentials  to  perform  the
search, his conduct violated a department policy against obtaining da-
tabase information for non-law-enforcement purposes.  Unbeknownst 
to Van Buren, his actions were part of a Federal Bureau of Investiga-
tion sting operation.  Van Buren was charged with a felony violation 
of the Computer Fraud and Abuse Act of 1986 (CFAA), which subjects
to  criminal  liability  anyone  who  “intentionally  accesses  a  computer 
without  authorization  or  exceeds  authorized  access.”    18  U. S. C. 
§1030(a)(2).  The term “exceeds authorized access” is defined to mean 
“to access a computer with authorization and to use such access to ob-
tain or alter information in the computer that the accesser is not enti-
tled so to obtain or alter.”  §1030(e)(6).  A jury convicted Van Buren, 
and the District Court sentenced him to 18 months in prison.  Van Bu-
ren  appealed  to  the  Eleventh  Circuit,  arguing  that  the  “exceeds  au-
thorized access” clause applies only to those who obtain information to
which their computer access does not extend, not to those who misuse 
access  that  they  otherwise  have.    Consistent  with  Eleventh  Circuit 
precedent, the panel held that Van Buren had violated the CFAA. 

Held: An individual “exceeds authorized access” when he accesses a com-
puter with authorization but then obtains information located in par-
ticular  areas  of  the  computer—such  as  files,  folders,  or  databases— 
that are off-limits to him. Pp. 5–20.

(a) (1) The parties agree that Van Buren “access[ed] a computer with
authorization” and “obtain[ed] . . . information in the computer.”  They