Supreme Court Limits The Scope Of Computer Fraud & Abuse Act

On June 3, 2021, the U.S. Supreme Court significantly narrowed the scope of the Computer Fraud and Abuse Act (CFAA) in Van Buren v. United States. In this closely watched case, the Court decided when a person "exceeds authorized access" under the Computer Fraud and Abuse Act (18 U.S.C. § 1030(a)(2)), holding that a Georgia police officer did not violate the CFAA when he overstepped his authorized access to government records. Ruling against the government, the Court held 6-3 that an individual who is authorized to access certain areas of a computer does not "exceed authorized access" under the CFAA, even when the individual accessed those areas of the computer for a prohibited purpose. The ruling has important implications not only for law enforcement but also for private plaintiffs who have relied on the CFAA's private cause of action for alleged improper access to their systems.