Sixth Circuit Deepens Computer Fraud And Abuse Act Circuit Split

Last week, the Sixth Circuit weighed in on a hotly debated question concerning the Computer Fraud and Abuse Act (CFAA): what does it take for someone to "exceed[] authorized access" to a computer system? As we recently explained, courts have split over whether the mere improper use of a computer, such as use that violates terms of service, constitutes a violation of the CFAA. The First, Fifth, Seventh, Eighth, and Eleventh Circuits have all answered that question affirmatively, while the Second, Fourth and Ninth Circuits have held that access is unauthorized only when a person bypasses some sort of code-based restriction or authentication gate, such as by guessing another user's password or exploiting a security flaw. With the split deepening, the Supreme Court recently granted certiorari in United States v. Van Buren, 940 F.3d 1192 (11th Cir. 2019) to resolve this ambiguity and determine the reach of the CFAA.