Picture the inside of a Georgia patrol car for a second. Nathan Van Buren was a police sergeant in Cumming, Georgia: badge, cruiser, and a login to the Georgia Crime Information Center (GCIC), the state’s own window into the FBI’s National Crime Information Center network. That login was nothing exotic. Running a license plate through GCIC wasn’t hacking. It was the job, routine work for cases and traffic stops, exactly what the badge was for.
Then an acquaintance dangled $5,000 in front of him, for one specific plate. He wanted to know whether a woman he’d met was an undercover cop. Van Buren said yes. He sat down at his own terminal, logged in with his own credentials, and typed in the plate. Same access he used every day. Different reason entirely.
(Nothing on the screen distinguished that search from any other search he was authorized to run.)
Here is where the story turns into a legal question worth losing sleep over. Van Buren wasn’t charged with breaking into a database he had no business touching. He was charged with breaking a promise about why he was touching one he’d always been allowed to use. He was convicted under the Computer Fraud and Abuse Act’s “exceeds authorized access” clause and sentenced to 18 months in federal prison, on the theory that using an authorized system for an unauthorized purpose is, by itself, a federal crime.
The question the Supreme Court actually had to answer
Van Buren never argued about the facts. He argued about the architecture underneath them: does the CFAA punish going where you’re not allowed, or why you went somewhere you were always allowed to go?
It turned out the federal circuit courts couldn’t agree either. Some, including the First, Fifth, Seventh, and Eleventh Circuits, read “exceeds authorized access” broadly enough to cover misusing access you legitimately hold: violate an employer’s computer-use policy, or a website’s terms of service, and on that reading you’ve committed a federal crime. (Read literally, that would make checking sports scores on the office Wi-Fi a federal offense. Congress, presumably, did not intend to deputize every IT department in America.) Others, the Second, Fourth, and Ninth Circuits, drew the line at a technical boundary only: files, folders, or database segments outside your credentials.
Strip away the legal language and it’s a systems-design question first. To answer it, someone has to know what a role-based access control actually restricts, and what an audit log actually captures.
The artifact: access the system granted, a purpose only the rulebook restricted
The evidence at the center of the case wasn’t a hack, a breach, or a stolen password. It was Van Buren’s own credentials, on his own terminal, retrieving one specific plate, a record indistinguishable, on the system’s own terms, from any authorized search.
GCIC’s technical access didn’t ask why at the moment of query; it granted Van Buren the plate-search function because his role entitled him to it. The restriction on purpose lived one layer up, in his department’s own training, which explicitly barred using the database for “any personal use.” Nothing in the login itself flagged Van Buren’s search as different from a legitimate one. The case broke open only because the acquaintance secretly recorded the conversation and reported it, which led to an FBI sting. The database itself never caught anything.
That gap, between what an access-control system technically permits and what a prosecutor wants a broken promise to prove, is exactly where a software expert earns their place in a courtroom. A generalist reads the record, sees “authorized user, authorized system, successful query,” and stops there. A court-appointed expert asks the harder question: does this system’s architecture even define “purpose” as an access parameter, or is the prosecution importing a distinction the software itself never made?
What the Court held, and why the technical gate won
On June 3, 2021, the Supreme Court reversed Van Buren’s conviction, 6-3, adopting what Justice Barrett’s majority opinion called a “gates-up-or-down” reading: the CFAA’s “exceeds authorized access” clause covers entering files, folders, or databases that are off-limits to you, not misusing information you were always allowed to reach. If Van Buren had access to the plate-search function at all, the statute didn’t care why he used it.
Notice what the ruling didn’t turn on. Not Van Buren’s honesty. Not his motive. Not the $5,000. It turned on what the access-control system technically permitted, because that is what the statute’s text actually asks a court to measure. (Van Buren’s conscience, in other words, was legally beside the point. Only the software’s “opinion” counted, and software famously doesn’t have one.)
Why access-log cases need a computer forensics expert witness
Every Israeli company running role-based access control (a fintech’s admin console, a healthtech’s patient database, an HR system with manager-only fields) is one internal-misuse incident away from the same question a US court had to answer: was this a technical boundary violation, or a policy violation the system never technically enforced?
You won’t find the distinction in a plain reading of a computer-use policy. It only lives inside the system itself: what does the access-control layer actually restrict, what does the audit log actually capture, and does either of them encode “purpose” at all? That’s not a question a litigator, or a generalist developer, can answer from a printout. It takes someone who can read the architecture and state, on the record, exactly what the system does and doesn’t distinguish, and defend that reading under cross-examination.
The side that brings in a computer forensics expert witness early, rather than once the evidence is already filed, is the side that holds.
The above is general information only and does not constitute legal advice. Specific facts of Van Buren v. United States are drawn from the sources cited.