Unauthorized access means a person had no right to enter the system or information at all. Exceeding authorized access, after this ruling, is narrower: it applies when someone has access to a system but reaches information they are not entitled to obtain. The key distinction is that purpose, policy, or fine print alone no longer define the boundary.
Why the CFAA draws a narrower line after Van Buren
The ruling matters because it separates access from misuse. Under this reading, the CFAA is not a catch-all for every policy breach, bad motive, or terms-of-service violation. The practical question is whether the person was entitled to obtain the information in the first place, not whether they later used it badly or acted against internal rules.
That distinction reduces the risk that ordinary workplace policy disputes, boundary-pushing research, or internal discipline issues are treated as federal computer crime. It also makes the statute easier to apply consistently, because the focus stays on access boundaries rather than subjective intent.
How unauthorized access differs from exceeding authorized access
Unauthorized access is the more direct concept: the person had no permission to enter the system or view the data at all. Exceeding authorized access, by contrast, assumes the person had some valid access, but then went beyond the information or functions their access allowed them to obtain. The ruling narrows that second category so it is not defined by purpose alone.
A useful way to test the difference is to ask whether the system itself, not just a workplace policy, limited access to the information. If the user could log in and reach the data technically, but later violated a policy about how to use it, that is not automatically the same thing as exceeding authorized access under this ruling.
What this means for investigations, policy, and security teams
For investigators, the practical task is to separate access control failures from rule violations. Evidence of login, role assignment, permissions, file access, and entitlement boundaries matters more than broad language in acceptable-use policies. That is why organisations should keep clear records of who can reach which systems and data, and why those permissions exist.
For security and legal teams, this reading also means that a badly governed access model can create ambiguity. If permissions are too broad, or if shared accounts blur who may see what, it becomes harder to show that a person truly lacked authority to obtain the data. Good access design therefore supports both prevention and later enforcement.
Risk and Threat Considerations
The main risk is over-reliance on policy language that never translated into technical control. When access boundaries are vague, organisations may assume a CFAA-style theory will cover misuse, but the stronger case usually depends on whether the system actually restricted the data path.
Failure mechanism: broad role design, shared credentials, or weak entitlement separation can let a user reach material they were not supposed to obtain, while still looking “authorised” on paper. That weakens both prevention and the ability to prove improper access later.
Impact: organisations may lose a clean legal and forensic distinction between valid access and improper data acquisition, which can complicate response, discipline, civil claims, and evidence preservation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Access scope determines whether use stayed within granted authority. |
| AU-2 — Event Logging | Investigations depend on logs that show who accessed what and when. | |
| Recommendation — Restrict permissions so users can only reach data and functions required for their role. Log access events to distinguish valid use from improper data acquisition. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account and entitlement governance reduces ambiguous access boundaries. |
| Recommendation — Manage accounts and entitlements so granted access is explicit and reviewable. | ||
Practitioner Guidance
What to verify: confirm the exact access path, entitlement set, and system boundary before treating a case as exceeding authorised access. The decisive question is not whether the person behaved badly, but whether the permission model actually stopped them from reaching the information.
Common mistake: treating policy violations, curiosity, or purpose drift as if they automatically equal computer trespass. That shortcut is risky because it can overstate the legal basis of the case and distract from the real control weakness, which is often overbroad access.
Practitioner takeaway: if you want the distinction to hold up, align policy with enforceable technical boundaries, because the CFAA analysis now turns far more on what the system allowed than on why the user looked.
Related resources from NHI Mgmt Group
- How should security teams manage SSH authorized keys to prevent persistent unauthorized access?
- How can teams tell whether AI access is actually under control?
- Who should be accountable for access review decisions under SOX or ISO 27001?
- How can security teams tell whether agent access is actually under control?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org