After Van Buren, insider snooping is an access design problem

The week

The story at the center of the case is small and very human. A police sergeant in Georgia was offered money to look up a license plate. He had a login to a law enforcement database and was allowed to run plate searches as part of his job. He ran this one for cash, for a purpose his department did not permit. The person asking turned out to be part of an FBI sting.

The details, as the Court later recounted them, were mundane. An acquaintance named Andrew Albo, working with the FBI, asked the sergeant to run a plate and paid him about $5,000. The sergeant used his patrol-car computer and his own valid credentials. Nothing about the search looked different, to the system, from the thousands of legitimate plate checks officers run every day.

He was convicted under the Computer Fraud and Abuse Act, or CFAA, the main federal law against computer crime, often described as the federal anti-hacking statute. The charge was that he had “exceeded authorized access”: he had permission to use the database, the argument went, but not for this.

The Eleventh Circuit upheld the conviction because its own 2010 precedent, United States v. Rodriguez, had read the law broadly. That case involved a Social Security Administration employee who used agency databases to look up personal information about people he knew. Other appeals courts disagreed. In 2015 the Second Circuit, in United States v. Valle, had reversed the CFAA conviction of a New York police officer who searched a law enforcement database without a law enforcement purpose. The Fourth and Ninth Circuits had also adopted the narrower reading.

The split mattered most for government employers. Two of the leading cases on opposite sides involved public employees searching government databases for personal reasons. Whether such conduct was a federal crime depended, until June 2021, on where the employee happened to work.

On June 3, 2021, the Supreme Court decided Van Buren v. United States. In a 6-3 opinion by Justice Barrett, the Court reversed the conviction.

Justices Breyer, Sotomayor, Kagan, Gorsuch and Kavanaugh joined the majority. Justice Thomas dissented, joined by Chief Justice Roberts and Justice Alito. The dissent argued that authorization to use property ordinarily depends on the purpose for which it was granted, and that the statute should be read the same way. The case had been argued in November 2020, by telephone, as the Court was still sitting remotely during the pandemic.

The CFAA dates from 1986 and has been amended many times. It defines exceeding authorized access as using authorized access to obtain or alter information the person is not “entitled so to obtain or alter.” Much of the argument turned on the small word “so.” The government read it as covering information obtained in a forbidden way, including for a forbidden reason. The majority read it as referring to information the person could not obtain by using their access at all.

The question was what “exceeds authorized access” means. One reading looks at purpose: if you use your access for a reason your employer forbids, you have exceeded it. The other reading looks at the system itself: you exceed your access only if you go into parts of the system you were never allowed into at all.

The Court chose the second. It held that the CFAA’s “exceeds authorized access” clause covers people who enter parts of a computer system, such as files, folders or databases, that are off-limits to them, but not people who are entitled to reach information and then use it for an improper purpose.

The distinction works like an office keycard. Say yours opens the third and fourth floors. If you badge into the fifth floor using a borrowed card, you have gone somewhere you were not allowed. If you walk onto the fourth floor, as permitted, and read a colleague’s files out of nosiness, you may be breaking company rules, and perhaps other laws, but under Van Buren you have not exceeded your authorized access for CFAA purposes.

The majority also gave a practical reason. A purpose-based reading, it said, would turn a vast amount of ordinary computer use into crime. Its examples included sending a personal email from a work computer under a business-use-only policy and breaking a website’s terms of service. In a footnote, the Court left one question open: whether the limits that matter must be technological, built into code, or could also be set by contracts and policies.

The ruling was celebrated by security researchers, who had worried that a broad reading of the law could criminalize their work. For government agencies that hold sensitive information about residents, the practical message was different and less comfortable: the federal anti-hacking law would no longer do much of the work of deterring employees from snooping in records their logins already let them see.

Every large organization that holds sensitive records has the same problem. Hundreds or thousands of employees can look up information about members of the public because their jobs require it. Most use that access exactly as intended. A few, from time to time, do not. They check an ex-partner’s new address, a neighbor’s benefits, a celebrity’s driving record. Sometimes it is curiosity. Sometimes it is something darker: stalking, harassment, or selling information, as in the sting at the center of Van Buren.

For years, the background threat of federal prosecution was part of how organizations deterred this behavior. Van Buren changed that, and it put more of the responsibility back on the systems and processes that agencies themselves control.

Van Buren was mostly discussed as a win for security researchers and a narrowing of a broadly worded statute. Both readings are fair. For agencies that hold sensitive records about residents, the decision had a more practical meaning. A common form of insider misuse, an employee looking up records they can technically reach but have no business reason to view, is generally no longer a federal computer crime. The Court framed the test as gates up or down: whether the person was allowed into that part of the system at all. If the system lets a user reach a record, the CFAA is unlikely to treat that access as unauthorized, however improper the motive.

What changed, and what did not

The Court’s reasoning was partly practical. A purpose-based reading would have criminalized everyday breaches of workplace computer policies. Take the employee who checks a sports score on a work computer whose policy says “business use only.” Under a purpose-based reading, that could in principle be a federal crime, which the Court found implausible.

The consequence is that technical authorization now does the work that policy language used to do. What the system actually lets a person reach now matters more than what the employee handbook says they should reach.

Other laws still apply. Unauthorized inspection of federal tax return information is a separate federal crime. The Driver’s Privacy Protection Act gives people a civil claim against anyone who obtains motor vehicle record data for an impermissible purpose; a civil claim means the person harmed can sue for damages, as opposed to the government bringing criminal charges. State computer crime, privacy and official misconduct laws vary. Agencies should check with counsel on which apply to their records.

But the most general federal deterrent narrowed, and agencies had to carry more of the weight themselves. Three controls do that work, and they fit together: design, which limits what a login can reach; monitoring, which records and reviews what users actually look at; and consequences, which make misuse costly.

The question the Court left open

The open footnote matters to anyone who designs access. If only technological limits count, an agency policy that says “view only your own caseload” does not create a gate. Only a system that enforces it does. If written policies can count, policy language still has some legal force.

The Justice Department answered for its own prosecutors in May 2022. Its revised CFAA charging policy says “exceeds authorized access” cases require a computer divided into areas through code or configuration, not through contracts or policies. The defendant must have been authorized for some areas but unconditionally barred from others, and must have entered a barred area knowingly. Merely misusing information the person was allowed to obtain is not enough. For federal charging purposes, then, the open question was closed in the narrowest way an agency could have expected.

Other legal levers, record by record

Which other laws apply depends on the record. Congress addressed tax return browsing directly in the Taxpayer Browsing Protection Act of 1997, after IRS employees were found looking at returns out of curiosity. That law makes unauthorized inspection a crime in its own right, whatever the system’s gates allow. The Privacy Act of 1974 carries criminal penalties for federal employees who willfully disclose protected records, but those penalties turn mainly on disclosure rather than viewing.

In health care, a workforce member who views a patient’s record without a job-related reason is making an impermissible use under HIPAA. The covered entity must apply sanctions under its own policies, and the viewing may count as a breach requiring notice to the patient. The Driver’s Privacy Protection Act lets people sue anyone who obtains their motor vehicle record for an impermissible purpose, with liquidated damages of $2,500 available. Banks and credit unions rely mainly on employment law, their information security programs under federal safeguards rules, and state law.

How much deterrence was lost

A fair counter-argument is that the CFAA never did much of this work. Federal prosecutors rarely charged an employee for an improper lookup unless money, stalking or another crime was involved. Most snooping was handled by discipline, if it was handled at all. On that view, Van Buren removed a threat that few insiders had ever felt.

The counter-argument is largely right about the past, and it strengthens the case for the three controls. If prosecution was always rare, agencies that leaned on it were relying on a deterrent that existed mostly on paper. Van Buren made that reliance visible. What actually protected records before 2021 was the same thing that protects them now: what the system allows, what it records and what follows.

How a records system decides who sees what

The three controls build on the way a typical government records system decides who sees what. The same ideas apply to a bank’s customer system or a hospital’s patient records.

When an employee signs in, the system first checks who they are. This is authentication: a password, a smart card, a code from a phone. Then it decides what they may do. This is authorization, and it is the part Van Buren is really about.

Most systems handle authorization with roles. A “caseworker” role can search cases and update notes. A “supervisor” role can also approve payments. A “clerk” role can look up any vehicle record. Roles are simple to manage, which is why they are popular. Their weakness is that they tend to be broad. A role usually grants access to an entire category of records, rather than the ones a particular person needs today.

A more precise approach is sometimes called attribute-based access. Instead of looking only at the person’s role, the system also checks the record and the situation: whether this case is assigned to this caseworker, whether this vehicle is registered in this clerk’s region, whether the request falls during the user’s shift. Access is granted only when the answers line up.

Finally, there is the audit trail: the system’s record of what each user did. Some systems record only when something is changed. Better ones also record when something is merely looked at. That distinction turns out to be central to insider misuse.

Where the authorization logic actually lives

In many public sector systems, authorization is scattered. Some rules live in the application’s code, some in the database, some in a central identity system, and some in a vendor’s configuration screens. Older mainframe systems often grant access by transaction code, so a user who can run a lookup transaction can run it against any record. Nobody may be able to say, without research, what a given user can actually reach.

Access also drifts. Employees who move between units often keep their old permissions alongside their new ones, a pattern known as privilege creep. Shared or generic accounts, still common at counters and in dispatch centers, break the link between a lookup and a person. After Van Buren, both problems matter more. A permission that should have been removed is still a permission, and a lookup no one can attribute cannot be disciplined.

Periodic access reviews address drift. A supervisor confirms, every quarter or half year, that each person on the team still needs each permission. The reviews work only if the list is readable. A screen showing transaction codes nobody understands invites a supervisor to approve everything.

How insider snooping happens in practice

In practice this behavior rarely resembles the hacking of films. There is no breaking in, no stolen password, no clever code. An employee simply types a name into a search box they use dozens of times a day.

The motives fall into a few familiar groups. The most common is curiosity: a well-known local figure is in the news, and someone wants to see what the records say. Next comes the personal: a former partner, a new neighbor, a relative in a family dispute. Less often, but more seriously, there is money, as in Van Buren, where someone outside the organization pays an insider to run searches. And occasionally there is intent to harm: an employee locating a person who has deliberately moved to get away from someone.

What makes this hard to stop is that the misuse looks, from the system’s point of view, almost identical to legitimate work. The same screens, the same search, the same login. The difference lies in the reason, and a computer cannot read minds. That is why the three controls focus on things a system can observe: whether the record has any connection to the user’s work, whether the pattern of lookups looks unusual, and whether there is a stated reason on file.

It is also why the problem tends to surface late. The person whose record was viewed usually has no idea it happened. Misuse often comes to light only when something goes wrong afterward: a harassing message, an unexpected visit, a complaint from someone who realizes an official knew things they should not have known.

Why the usual security tools miss it

Most security tooling is built to catch outsiders or data leaving the building. Data loss prevention tools watch for files being emailed or copied to a drive. Network monitoring watches for unusual connections. A snooping employee does neither. The record appears on a screen, is read, and is closed. If anything leaves, it leaves in someone’s memory or as a photo taken with a personal phone.

The central security monitoring system usually sees logins, not record views. Unless the application’s own logs are fed into it, the security team has no visibility into what a user looked at. Detection of insider snooping therefore depends on application-level logging, and on someone who understands the business well enough to read it.

Paid lookups and outside pressure

The Van Buren facts, an outsider paying an insider, describe a recurring pattern beyond policing. Criminal groups have repeatedly recruited or bribed employees of telecom carriers, banks and government offices to look up or change account information. Those insiders are usually legitimate users acting within their system permissions. For a bank or a carrier, the question after Van Buren is the same as for an agency: what the job requires a person to see, and how quickly an unusual pattern is noticed.

Design: narrowing what a login can reach

The gap matters most where many employees have broad access to sensitive records for legitimate reasons. Law enforcement databases are the obvious case, and the facts of Van Buren came from one. Others include motor vehicle records, tax and revenue systems, benefits eligibility systems, child welfare and court records, and patient records in public hospitals and health departments.

In all of these, broad access is often a convenience choice. A caseworker may need to search across all cases to find duplicates. A clerk may need to look up any vehicle. Those designs assumed that policy and the threat of prosecution would deter misuse. After Van Buren, the gate itself matters more.

Design options run from strict to light. Attribute-based rules can limit users to records connected to their caseload, unit or region, with a documented process for exceptions. Where broad search is genuinely needed, a system can return a minimal result, such as a match indicator, and require a case number or stated reason before showing full details. Break-the-glass access, familiar from hospital records, lets a user open a restricted record in an emergency but flags the event for review. The name comes from the fire alarm behind glass: anyone can pull it in an emergency, but everyone knows it was pulled.

Each adds friction, so the right choice depends on how often legitimate users need wide reach. Requiring a reason does not stop a determined insider, but it creates a record and a moment of reflection.

Who controls the design

Many agencies do not control the design of the systems their staff use. A county sheriff’s office may query a statewide criminal justice network it cannot reconfigure. County caseworkers in several states use eligibility systems built and run by the state. A city clerk may use a vendor’s cloud application with fixed permission settings.

In these cases, the levers are different. The local agency controls who gets an account, which role each account receives and how quickly accounts are removed. It can ask the system owner for view logs and for regular reports on its own users. The system owner controls the gates themselves, and changes usually wait for a release cycle or a contract renewal. State agencies that run shared systems are, in effect, setting the insider risk posture for every local agency that connects.

The service trade-off

The strongest objection to narrow access comes from frontline service. A resident calls about a case, and the person who answers is not the assigned worker. An officer on night shift needs a record outside the usual area. A credit union member walks into a branch that is not their home branch. Narrow gates make each of those moments slower, and the cost falls on the public and on frontline staff.

The answer is graduated access rather than a single setting. Routine records stay open to the people who routinely need them. Sensitive categories, such as staff records, protected addresses or high-profile individuals, sit behind a reason prompt or a break-the-glass step. Wide access is kept where service genuinely requires it, and is paired with closer monitoring there.

Reason prompts that produce useful data

A reason prompt is only as good as what it captures. Free-text boxes fill up with “work” or a single period within weeks. A short list of reason codes, combined with a case or incident number that the system checks against the case management system, produces data a reviewer can use. A lookup tied to an open case assigned to the user needs no review. A lookup with no case, or a case belonging to another unit, goes into the queue.

Prompts also wear off. Staff learn to click through them. Periodic sampling of stated reasons against actual work, and visible follow-up when reasons do not match, keeps the prompt meaningful.

One county benefits system, redesigned

Suppose a county human services department runs a benefits system that lets all 300 caseworkers search every household in the county, because staff sometimes cover for colleagues and need to check for duplicate applications. After reviewing the risk, the department makes three changes. Caseworkers now see full details only for households on their own caseload or their unit’s. A county-wide search still works but returns only “match found” and the name of the assigned worker, unless the caseworker enters a case number and reason. And records flagged as sensitive, such as those of department staff, require a break-the-glass step that notifies a supervisor. Legitimate work slows by a few seconds. Casual browsing becomes much harder, and every exception leaves a trail.

The same question in hospitals and banks

Health systems face this design question under a specific rule. HIPAA’s minimum necessary standard requires covered entities to limit workforce access to protected health information based on job role. Large electronic health record platforms support break-the-glass controls and flags for sensitive patients, such as employees and well-known people. Hospitals were among the first to treat view logging and pattern review as routine, because celebrity record snooping cases drew regulatory attention years before Van Buren.

Banks and credit unions face it less formally. Branch and call center staff typically see a broad range of customer accounts, because any customer may walk in or call. A small credit union may have a handful of employees, each able to see every member. There, monitoring and consequences carry more of the load than design. Flagging employee lookups of fellow employees, relatives and board members is a reasonable start.

Monitoring: logging every look

Many systems log changes to records but not views. That is backwards for this risk. Insider misuse is mostly reading: checking an ex-partner’s address, a neighbor’s benefits, a celebrity’s driving record. Systems holding sensitive records should log every query and every record opened, with user, time, search terms and results returned.

Logs only deter if someone reviews them, and random sampling finds little. Pattern-based review works better: lookups of colleagues, public figures, people who share the user’s surname or street, records viewed outside the user’s assigned caseload, and bursts of searching late at night.

For criminal justice information, the FBI’s CJIS Security Policy already requires audit logging for agencies and contractors. Federal tax information carries similar audit expectations under IRS rules for agencies that receive it. Those requirements give a starting point, but compliance with logging rules is not the same as using the logs. Someone needs to own the review, with time budgeted for it, and analytics can help prioritize what that person sees. “Analytics” here simply means software that sorts through millions of log entries and surfaces the handful that match suspicious patterns, so a human reviewer can spend time where it counts.

Two details are easy to miss. Database administrators and vendor support staff often have the widest access of anyone and the least monitoring, so their activity needs review by someone outside their chain. And logs must be kept long enough to matter. Misuse often comes to light months later, when a victim complains, so a retention period of a few weeks leaves investigators with nothing to examine.

What a useful lookup log records

A log that supports an investigation answers six things: who, when, from where, what was searched, what came back and what was opened. That means a unique user identifier, a reliable timestamp, the workstation or network address, the search terms, the list of results and each record viewed. If the system asks for a reason or case number, that belongs in the log too.

The log must also be trustworthy. Administrators of the application should not be able to edit or delete it. Copies should flow to storage that a separate team controls. Clocks across systems should be synchronized, so that a lookup can be matched to a phone call or a door badge.

Benchmarks agencies can point to

Federal agencies have explicit requirements. OMB memorandum M-21-31, issued in August 2021, set tiers of logging maturity. It required agencies to keep many types of logs for 12 months in active storage and a further 18 months in cold storage. The NIST SP 800-53 audit and accountability controls set out what to log and how to protect it. For covered health care entities, the HIPAA Security Rule requires audit controls and regular review of information system activity.

State and local agencies may not be bound by the federal memo. Its retention periods still give them a defensible reference point when a budget request for log storage needs a justification.

Watching the watchers

Monitoring employees raises its own issues. In unionized public workplaces, new forms of monitoring can be a subject of bargaining, so labor relations should be involved early. Reviewers themselves gain access to sensitive patterns of activity, and their own lookups should be logged and reviewed. And some flags will be false: an HR specialist looks up colleagues as part of the job. Reviewers need a fast way to clear legitimate patterns, or they will stop reading the queue.

Consequences: making misuse costly

Monitoring only deters if misuse leads to action that employees know about. Clear policies help, but what changes behavior is evidence that people are caught. Annual training that uses real, anonymized examples from the agency’s own reviews, warning banners at login that state lookups are recorded and audited, and consistent discipline all contribute. Agencies that publish aggregate outcomes internally, such as the number of cases investigated and the actions taken, without naming individuals, tend to see behavior change.

Consequences also need coordination outside IT. Human resources, labor relations, the inspector general or internal affairs, and prosecutors under state law each have a role. Agreeing in advance how a flagged lookup is referred, investigated and resolved avoids cases stalling because no office believes it owns them.

Making discipline stick

In the public sector, discipline is a legal process. Civil service rules, collective bargaining agreements and grievance arbitration all apply. Arbitrators look at whether the employee had clear notice of the rule, whether the evidence is reliable and whether similar cases were treated alike. An agency that disciplines one snooper harshly after years of ignoring others may lose the case.

The controls described above double as evidence. A signed acknowledgment of the access policy shows notice. A tamper-resistant view log shows what happened. A record of past outcomes shows consistency. Agencies that build these before the first serious case are in a much stronger position when it comes.

Parallel tracks for police and other investigations

Where criminal charges under state law are possible, the administrative and criminal tracks need coordination. For police officers and many other public employees, statements compelled in an administrative inquiry generally cannot be used against them in a criminal case, under the Supreme Court’s 1967 decision in Garrity v. New Jersey. Agencies should agree with prosecutors and counsel how to sequence interviews so that one track does not spoil the other.

The person whose record was viewed also has interests. In health care, an improper view may trigger breach notification. Elsewhere, state law or agency policy may call for telling the person. Deciding in advance who makes that call, and on what criteria, avoids inconsistent treatment of victims.

Getting started without boiling the ocean

The work does not require replacing every system at once. A sensible sequence for a department or agency starts with an inventory: which systems hold sensitive records about people, how many staff can reach each record, and whether views are logged. That alone often surprises leadership, because the number of people with broad access is usually larger than anyone assumed.

Next, pick the one or two systems with the widest access to the most sensitive data and start there. Turn on view logging if it is available, extend log retention, and assign a reviewer with a modest weekly time budget and a short list of patterns to check. Add a warning banner at login. These steps cost little and change behavior quickly, because staff can see that something is different.

Design changes take longer, since they may require vendor work or new configuration. Build them into the next upgrade or contract renewal, so that narrower access, reason prompts and break-the-glass steps become requirements rather than afterthoughts. Meanwhile, agree the referral path with HR, internal affairs and counsel, so that the first flagged case is handled smoothly rather than becoming an argument about ownership.

A first ninety days

A realistic first quarter looks like this. In the first month, complete the inventory and switch on view logging wherever the system supports it. In the second, name a reviewer for the highest-risk system, agree a short pattern list and add the login banner. In the third, settle the referral path with HR, internal affairs and counsel, and brief leadership on the first results. Design changes then go into the roadmap for the next upgrade or renewal. Each step produces evidence that a council, board or legislative oversight committee can see, and none of them requires a new system or new legislation.

Measures that show progress

A small set of measures lets leadership see whether the program is working. For each sensitive system: how many staff can view any given record, and whether that number is falling. Whether views are logged, and for how long logs are kept. How many flagged lookups were reviewed each month, and how long each took to resolve. How many access reviews were completed on time.

The numbers matter less than the trend and the conversation they prompt. A program director who sees that 2,000 people can open any record in a benefits system will ask why. That question is often what unlocks the budget for design changes.

Procurement is the other lever. Requests for proposals for new records systems should require view logging, exportable logs, attribute-based permissions, reason prompts and break-the-glass support. Vendors build what buyers ask for. Agencies that write these into contracts improve the products other agencies buy as well as their own.

Who gets hurt, and who is exposed

The people in the records. Insider misuse is rarely a large data breach. It is one person’s address in the wrong hands. The harm can be severe and very personal, and the public reasonably expects agencies to prevent it.

The most serious cases involve people who have taken deliberate steps to hide. Many states run address confidentiality programs for survivors of domestic violence and stalking, which substitute a designated address in public records. Those programs depend on the underlying systems keeping the real address out of reach. A single insider lookup can undo years of careful protection.

Legal exposure. Laws such as the Driver’s Privacy Protection Act create civil claims, and state laws add more. An agency that cannot show reasonable controls is in a weaker position when a case arises.

Trust and reputation. A single story about an employee snooping on a resident can undermine confidence in an entire department, and residents who distrust an agency may avoid services they need.

Staff. Most employees never misuse access. Clear rules, consistent enforcement and systems that do not tempt casual browsing protect them too, by making expectations unambiguous and fair.

Where agencies fall short

A well-run agency knows which of its systems hold sensitive records and how many people can reach each record; has narrowed broad access where it can; logs views as well as changes, keeps the logs for a meaningful period, and has a named person reviewing them by pattern; and has agreed, across HR, internal affairs and legal, what happens when a lookup is flagged.

The failures elsewhere follow a familiar pattern:

• Relying on policy alone. A rule in the handbook with nothing in the system to back it up.
• Logging edits, not views. Recording when data changes, but not when someone simply reads it.
• Logs nobody reads. Meeting the letter of an audit requirement without anyone assigned to look.
• Overlooking the most powerful users. Monitoring frontline staff while administrators and vendor support staff go unreviewed.
• Short retention. Discarding logs after a few weeks, before most complaints arrive.
• Silent outcomes. Disciplining people out of sight, so the rest of the workforce never learns that misuse is caught.

These failures share a root cause. Each treats insider misuse as a matter of employee character, to be handled by policy and trust. Van Buren shifted the question to systems and process, which agencies can measure, budget for and improve. Agencies that make that shift tend to find the work less daunting than expected, because the first steps are inexpensive and visible.

Checking our own records systems

1. Which of our systems hold sensitive information about residents, customers or patients, and how many employees can see any given record in each?
2. Do our systems record when someone views a record, or only when they change it?
3. Who reviews those records, how often, and what patterns are they looking for?
4. How closely are database administrators and vendor staff monitored, and by whom?
5. When a suspicious lookup is flagged, which office takes it, and is that written down?

Answering them requires no new system. It takes an afternoon with the system owners, the security team and HR in one room. The answers will show where the gates are up that should be down, and where a lookup would go unnoticed today.

With hindsight

In May 2022, the Justice Department revised its CFAA charging policy, directing prosecutors not to charge good-faith security research. That settled much of the worry that had made the case famous among technologists: people who probe systems to find and report weaknesses are, in federal charging policy at least, no longer treated as criminals for doing so in good faith. On that front, Van Buren had the effect most observers expected.

The same policy went further than the Court had. It told prosecutors that “exceeds authorized access” charges require areas of a computer divided by code or configuration, not by contracts or policies. For federal charging purposes, the question the Court left open in its footnote was settled on the narrow side. Agencies that had hoped a well-drafted acceptable use policy would preserve federal deterrence learned that only enforced technical limits would.

Courts applied the gates-up-or-down test in later cases, including disputes over scraping of public websites. Scraping means using software to collect information automatically from web pages. If a website is open to the public, the reasoning goes, the gate is up, and collecting what anyone could see is hard to call unauthorized access under the CFAA.

The leading scraping case moved quickly. Less than two weeks after Van Buren, the Supreme Court sent hiQ Labs v. LinkedIn back to the Ninth Circuit for reconsideration in light of the decision. In April 2022 the Ninth Circuit again concluded that scraping publicly available profiles was unlikely to be access “without authorization.” The dispute was later resolved largely on contract grounds, a reminder that terms of service still carry weight in civil law even where computer crime law does not reach.

Insider misuse of government databases did not stop. Cases of employees misusing law enforcement, motor vehicle and benefits systems kept appearing in news reports and inspector general findings, typically handled through discipline and state law. The problem the sergeant’s case illustrated is persistent, because it grows from ordinary human temptation combined with broad access.

Federal logging expectations rose in parallel, for reasons that had more to do with outside attackers than insiders. OMB’s August 2021 memorandum on event logging, issued under the May 2021 executive order on cybersecurity, pushed federal agencies toward longer retention and centralized log access. The FBI also began modernizing its CJIS Security Policy in 2022, aligning it more closely with NIST controls and tightening requirements such as multi-factor authentication. Neither change was aimed at snooping. Both made the logs and attribution that snooping investigations depend on more common.

What changed most was the expectation placed on agencies’ own controls, with query logging and pattern-based review now more common. That shift is healthy. It moves protection from an after-the-fact prosecution, which reached few cases anyway, to everyday design and oversight that can prevent harm or catch it early.

Congress did not amend the CFAA in response to Van Buren, so the gates test remains the law of the land for federal computer crime.

Where agencies struggled, the obstacles were usually practical. Legacy systems could not log views without vendor work. State-run systems left local agencies dependent on someone else’s release schedule. Reviews competed with other duties for scarce staff time. Those constraints have eased with system replacements and cloud migrations, but unevenly, and smaller agencies have generally moved last.

The decision’s core message holds: if a system lets someone see a record, federal computer crime law will mostly treat that as allowed, so the system has to be designed with that in mind. The practical question is no longer whether misuse is illegal but what the system lets people see, who is watching, and what happens when someone crosses the line. Those questions apply equally to a bank’s customer files and a hospital’s patient records.