On June 3, 2021, the Supreme Court issued a 6-3 decision in
Van Buren v. United States, narrowing the scope of the Computer Fraud and Abuse Act (CFAA). In resolving a circuit split in favor of a limited interpretation of the phrase “exceeds authorized access,” the Court held that the criminal provisions of the CFAA do not apply to individuals who have authorized access to computer information, but access that information for a reason that is not permitted. The Court’s ruling curtails the federal government’s ability to charge individuals with computer fraud, including the criminalization of commonplace and potentially harmless conduct, such as sending a personal email through a work computer when a company’s policy precludes such use of the computer system.