After Van Buren, Exceeds Authorized Access Is a Gates Question

"Exceeds authorized access" now asks one question: was the user entitled to reach this area of the system at all? Misusing data you were entitled to see is no longer a CFAA violation. That single move in Van Buren killed a decade of employee-disloyalty claims, left the scraping cases half-resolved, and pushed the fight onto ground where forensic evidence about access controls matters more than evidence about motive.

This article is educational. It is not legal advice, and it is not a substitute for reading the statute and the opinions themselves.

What did Van Buren actually decide?

Van Buren v. United States holds that a person "exceeds authorized access" under the Computer Fraud and Abuse Act only by accessing files, folders or databases that are off limits to him — not by obtaining, for an improper purpose, information he was otherwise entitled to reach. The Court reversed the conviction of a police sergeant who ran a licence-plate search he was authorised to run but did so for payment.

The Court read both operative CFAA clauses consistently as a gates-up-or-down inquiry: either one may access a system or an area within it, or one may not. Reading "without authorization" as a gates question while making "exceeds authorized access" turn on the circumstances would be inconsistent with the design and structure of the subsection. In the Court's own framing, liability under both clauses stems from a gates-up-or-down inquiry — one either can or cannot access a computer system, and one either can or cannot access certain areas within the system.

And then the Court left the most practically important question open. It expressly reserved whether the inquiry turns only on technological limits, or also on limits stated in contracts and policies. That reservation is the source of most of the current uncertainty, and any brief that presents this area as settled is overclaiming.

Which pre-Van Buren cases survive and which are gone?

The circuit split Van Buren resolved ran for over a decade, and knowing which side a case was on tells you whether it still helps you.

Consistent with Van Buren — still useful.

• LVRC Holdings LLC v. Brekka holds that an employee permitted to use his employer's computer does not access it "without authorization" by emailing company documents to himself for later use, and does not exceed authorised access where he was entitled to obtain those documents. Whether access is authorised turns on the employer's own decision to grant or revoke it, not on the employee's disloyal state of mind.
• United States v. Nosal, en banc, holds that "exceeds authorized access" is limited to violations of restrictions on access to information, and does not extend to violations of restrictions on its use. The court read "entitled" in the statutory definition as a synonym for "authorized," stressed that a single definition governs every use of the phrase across the statute, and observed that a use-based reading would make every breach of a private computer-use policy a federal crime given how broadly "protected computer" is defined.
• WEC Carolina Energy Solutions LLC v. Miller holds that an employee exceeds authorised access only when he has approval to access a computer but uses that access to obtain or alter information falling outside the bounds of his approved access; because the former employee had authorised access to what he downloaded, the claim failed.
• United States v. Czubinski reversed computer-fraud and wire-fraud convictions where an IRS employee browsed taxpayer files in breach of agency rules, holding that conduct could not without more sustain those counts.

Inconsistent with Van Buren on the access-versus-use question.

• United States v. Rodriguez held that a Social Security Administration employee exceeded authorised access by looking up personal details of seventeen people for non-business reasons in breach of an agency policy prohibiting access without a business reason. That is the purpose-based reading Van Buren rejected. Cite it for the proposition that the CFAA requires no proof the information was used to further another crime or for gain — which remains correct — and not for the access holding.
• EF Cultural Travel BV v. Explorica, Inc. affirmed a preliminary injunction on a CFAA theory where a competitor used a purpose-built scraper to harvest tour pricing from a rival's public website, resting on the breach of a confidentiality agreement — the scraper made more than thirty thousand queries and relied on internal tour codes whose meaning was not publicly understandable. The confidentiality-agreement route is exactly the contract-based theory Van Buren declined to bless or reject.

The practical instruction for a brief: if the authority you are about to cite turns on why the user looked, stop. If it turns on whether the user could reach the data, it probably still works.

Does the narrowing apply to the criminal and the civil side alike?

Yes, and that is one of the more consequential structural features of the statute. The CFAA creates criminal liability and, through § 1030(g), a private civil cause of action, and the operative access language is the same in both. Van Buren was a criminal appeal; Brekka and WEC Carolina were civil employer suits; the analysis crossed over without difficulty because the phrase being construed is identical.

That matters to how employers now plead trade-secret and departing-employee cases. Before 2021, the CFAA count was attractive precisely because it supplied a federal hook and a federal forum without having to plead trade-secret elements. After Van Buren, where the departing employee had ordinary access to the files he took, the count is likely to fail on the pleadings — which is what happened in Brekka and WEC Carolina, and the reasoning in Nosal explains why: a use-based reading would make every breach of a private computer-use policy a federal offence given how broadly "protected computer" is defined, and ambiguity in a criminal statute had to be resolved against that result. The remaining federal routes in those cases are the federal trade-secret statute and, where the conduct reached messages rather than files, the communications privacy statutes.

The civil-side corollary for examiners is that the theory of the case now determines what is worth examining. Volume of files copied to a USB device still matters to damages and to a trade-secret claim. It does very little for a CFAA count if the employee was entitled to open every one of them.

Where does this leave web scraping?

Unresolved, but trending against CFAA liability for genuinely public data.

hiQ Labs, Inc. v. LinkedIn Corp., decided on remand after Van Buren, again affirmed a preliminary injunction requiring LinkedIn to stop blocking a data-analytics company from scraping publicly available member profiles. It held that Van Buren reinforced serious questions about whether the CFAA reaches access to data open to anyone with a web browser, and therefore whether the statute could pre-empt the scraper's tortious-interference claim. The court read the gates-up-or-down framing to imply that the CFAA presupposes some authorisation gate; where a profile is public, there is no gate to pass. It distinguished earlier cases involving data behind a username-and-password system, and noted that LinkedIn had not alleged the scraping caused the kind of technological harm the statute addresses. It also observed that site operators are not without remedies — trespass to chattels, copyright, and contract claims may remain available.

Two limits on that, both important.

First, it is a preliminary-injunction posture: "serious questions" is not a merits holding, and it is one circuit.

Second, Facebook, Inc. v. Power Ventures, Inc. holds that a social-aggregation service that accessed a platform's user data with the users' consent did not violate the CFAA while it had the platform's implied permission, but did violate the CFAA and California Penal Code § 502 once the platform sent a cease-and-desist letter and blocked its IP address and it nonetheless continued. So a revocation event — a letter, an IP block — can close the gate even where the data itself is not password-protected. That holding sits uneasily beside hiQ's public-profile reasoning, and the two are frequently argued against each other.

What does a forensic examiner actually need to establish now?

The change in doctrine changes the evidence. Before Van Buren, the winning exhibit was often the acceptable-use policy plus proof of a disloyal motive. Now the exhibit that matters is proof about the access control itself.

Concretely, the questions an examination should be scoped to answer:

• What were the permissions on the resource at the time of access? Access-control lists, group membership, role assignments, share permissions, database grants, and the change history of each. "He was not supposed to look" and "he could not have looked without escalating" are different findings.
• Was there a technological gate, and was it circumvented? Credential reuse, a shared service account, a password belonging to someone else, privilege escalation, a token replayed, an API key used outside its intended scope. Each of those is evidence of a gate; a policy document is not.
• Did the user reach an area outside his own? Authentication and authorisation logs, directory-service events, VPN and remote-access records, file-server audit logs, application audit trails. The unit of analysis is the resource boundary, not the file count.
• When was permission revoked, and what happened after? This is the Power Ventures question. The artefacts are the revocation event itself — the letter, the block, the disabled account, the removed group membership — and the access attempts on either side of it.
• What was the technological harm, if any? hiQ noted its absence. Availability impact, rate-limit breach, resource exhaustion, and integrity changes are the observable categories.

The joint sentence between the forensic and legal halves is this: after Van Buren, the examiner's finding about the state of an access-control boundary at a specific moment is the fact the legal test now turns on, and a report that catalogues volume of data taken while saying nothing about entitlement is answering the pre-2021 question.

Two collateral points worth knowing. The CFAA has a civil cause of action, and the limitations rules are not intuitive: Sewell v. Bernardin held that the CFAA and Stored Communications Act limitations periods run from discovery of the particular violation, and that unauthorised access to separate accounts gives rise to separately accruing claims — so claims about an email account discovered more than two years before suit were time-barred while claims about a later-discovered social-media account were timely. That means the forensic question "when was each compromise discoverable" has independent legal consequence. And the CFAA is not the only statute in play: where the conduct involves messages rather than stored files, the Wiretap Act and Stored Communications Act analysis in Konop v. Hawaiian Airlines and Theofel v. Farey-Jones may reach conduct the CFAA no longer does — Theofel in particular holding that consent procured by deceit is no consent.

What is still genuinely unsettled?

Say this out loud in a memo rather than papering over it:

1. Whether contract and policy limits can create a "gate." The Supreme Court reserved it. Until a court of appeals squarely resolves it for your circuit, a terms-of-service theory is a real argument and a real risk.
2. Whether a cease-and-desist letter or IP block closes the gate on public data. Power Ventures says a revocation event mattered on its facts; hiQ raises serious questions about public data generally. Both are Ninth Circuit.
3. What counts as an "area" within a system. A folder? A database table? A row? The gates metaphor is clean at the system level and much less clean inside a single application.
4. State computer-crime statutes. They are not uniform with the CFAA, and Van Buren does not construe them. Power Ventures upheld liability under a California penal provision alongside the CFAA, which is a reminder that a federal narrowing does not necessarily narrow the state claim.

For lawyers who want the underlying systems literacy this area now demands, the Digital Forensics for Lawyers track and Cracking the Digital Case are the relevant routes; on the reference side, NIST SP 800-86 covers the log sources these access questions are answered from, and the DOJ CCIPS manual states the government's own reading of the statute.