Computer Fraud and Abuse Claims After Van Buren

The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, is a criminal statute that also provides a civil cause of action. For years, employers used it against departing employees who misused information they were permitted to access. The Supreme Court's 2021 decision in Van Buren v. United States changed that landscape.

The holding

The Court held that a person exceeds authorized access when they access areas of a computer, such as files, folders or databases, that are off limits to them. It does not reach someone who has authorized access to information but uses it for an improper purpose.

Impact on employee cases

Claims based solely on misuse of information an employee was allowed to view are now difficult under the CFAA. Those situations are often better addressed through trade secret law, contract claims, or breach of duty theories.

Civil claim requirements

A civil plaintiff must show damage or loss and satisfy one of the statute's qualifying factors, most commonly a loss of at least $5,000 in a one-year period. Courts have read loss to focus on costs such as investigating and responding to the intrusion and restoring systems.

Evidence is everything

Whether access was truly unauthorized often turns on technical facts: account permissions, access logs, authentication records and system configurations. Early forensic preservation is essential to proving, or disproving, a claim.