There's an important distinction between levels of government and civil vs. criminal penalties here. From section a.4 of the holding: "The relevant question,

There's an important distinction between levels of government and civil vs. criminal penalties here. From section a.4 of the holding: "The relevant question, however, is not whether Van Buren exceeded his authorized access but whether he exceeded his authorized access as the CFAA defines that phrase." The CFAA is a federal statute that governs unauthorized access to computer systems. When granting authorized access to computer systems, other organizations (whether states or police departments or private companies) are free to set their own policies, and they can enforce those policies with the mechanisms they have available to them, like terminating the offending officer or revoking his computer access (at which point further access would be a CFAA violation). But can they then use the language of the CFAA to criminalize violations of their own authorization policies? This holding says no - the CFAA covers the initial access to the computer system, and then violation of more granular access policy is a civil matter between the individual parties. This is consistent with several other recent court positions. There was a recent case to criminalize ToU violations [1]; the court ruled that this is an overbroad reading of the CFAA and ToU violations were civil matters between parties. When Anthony Levandowski used Google's network to download self-driving car plans and sell them to Uber [2], he was prosecuted under "theft of trade secret" laws, not under the CFAA. It's also analogous to perpetual free speech battles, where the court has repeatedly ruled that private parties are free to restrict speech on their own property, and that the 1st amendment applies only to the government. In general liberal democracies seek to apply restrictions as narrowly as possible and have private parties work out contracts and consequences amongst themselves, only stepping in when there is no way to enforce such agreements without an outside power. [1] https://arstechnica.com/tech-policy/2020/03/court-violating-a-sites-terms-of-service-isnt-criminal-hacking/ https://arstechnica.com/tech-policy/2020/03/court-violating-... [2] https://www.justice.gov/usao-ndca/pr/former-uber-executive-sentenced-18-months-jail-trade-secret-theft-google https://www.justice.gov/usao-ndca/pr/former-uber-executive-s...