After Van Buren, insider snooping is an access design problem
The Supreme Court’s June 2021 Van Buren decision took most purpose-based insider misuse out of the federal computer crime law. For agencies holding sensitive records, deterrence now rests on three controls they own: access design, query monitoring and consequences.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On June 3, 2021, the Supreme Court decided Van Buren v. United States. The case involved a former police sergeant in Georgia who, for money in what turned out to be an FBI sting, ran a license plate search in a law enforcement database he was authorized to use, for a purpose his department did not permit. He was convicted under the Computer Fraud and Abuse Act (CFAA) for exceeding authorized access. In a 6-3 opinion by Justice Barrett, the Court reversed. It held that the CFAA’s “exceeds authorized access” clause covers people who enter parts of a computer system, such as files, folders or databases, that are off-limits to them, but not people who are entitled to reach information and then use it for an improper purpose.
Van Buren was mostly discussed as a win for security researchers and a narrowing of a broadly worded statute. Both readings are fair. For agencies that hold sensitive records about residents, the decision had a more practical meaning. A common form of insider misuse, an employee looking up records they can technically reach but have no business reason to view, is generally no longer a federal computer crime. The Court framed the test as gates up or down: was the person allowed into that part of the system at all? If the system lets a user reach a record, the CFAA is unlikely to treat that access as unauthorized, however improper the motive.
The Court’s reasoning was partly practical. A purpose-based reading would have criminalized everyday breaches of workplace computer policies. The consequence is that technical authorization now does the work that policy language used to do. Other laws still apply. Unauthorized inspection of federal tax return information is a separate federal crime. The Driver’s Privacy Protection Act gives people a civil claim against anyone who obtains motor vehicle record data for an impermissible purpose. State computer crime, privacy and official misconduct laws vary. Agencies should check with counsel on which apply to their records. But the most general federal deterrent narrowed, and agencies had to carry more of the weight themselves. Three controls do that work, and they fit together: design, which limits what a login can reach; monitoring, which records and reviews what users actually look at; and consequences, which make misuse costly.
Design: narrowing what a login can reach
The gap matters most where many employees have broad access to sensitive records for legitimate reasons. Law enforcement databases are the obvious case, and the facts of Van Buren came from one. Others include motor vehicle records, tax and revenue systems, benefits eligibility systems, child welfare and court records, and patient records in public hospitals and health departments.
In all of these, broad access is often a convenience choice. A caseworker may need to search across all cases to find duplicates. A clerk may need to look up any vehicle. Those designs assumed that policy and the threat of prosecution would deter misuse. After Van Buren, the gate itself matters more.
Design options run from strict to light. Attribute-based rules can limit users to records connected to their caseload, unit or region, with a documented process for exceptions. Where broad search is genuinely needed, a system can return a minimal result, such as a match indicator, and require a case number or stated reason before showing full details. Break-the-glass access, familiar from hospital records, lets a user open a restricted record in an emergency but flags the event for review. Each adds friction, so the right choice depends on how often legitimate users need wide reach. Requiring a reason does not stop a determined insider, but it creates a record and a moment of reflection.
Monitoring: logging every look
Many systems log changes to records but not views. That is backwards for this risk. Insider misuse is mostly reading: checking an ex-partner’s address, a neighbor’s benefits, a celebrity’s driving record. Systems holding sensitive records should log every query and every record opened, with user, time, search terms and results returned.
Logs only deter if someone reviews them, and random sampling finds little. Pattern-based review works better: lookups of colleagues, public figures, people who share the user’s surname or street, records viewed outside the user’s assigned caseload, and bursts of searching late at night. For criminal justice information, the FBI’s CJIS Security Policy already requires audit logging for agencies and contractors. Federal tax information carries similar audit expectations under IRS rules for agencies that receive it. Those requirements give a starting point, but compliance with logging rules is not the same as using the logs. Someone needs to own the review, with time budgeted for it, and analytics can help prioritize what that person sees.
Two details are easy to miss. Database administrators and vendor support staff often have the widest access of anyone and the least monitoring, so their activity needs review by someone outside their chain. And logs must be kept long enough to matter. Misuse often comes to light months later, when a victim complains, so a retention period of a few weeks leaves investigators with nothing to examine.
Consequences: making misuse costly
Monitoring only deters if misuse leads to action that employees know about. Clear policies help, but what changes behavior is evidence that people are caught. Annual training that uses real, anonymized examples from the agency’s own reviews, warning banners at login that state lookups are recorded and audited, and consistent discipline all contribute. Agencies that publish aggregate outcomes internally, such as the number of cases investigated and the actions taken, without naming individuals, tend to see behavior change.
Consequences also need coordination outside IT. Human resources, labor relations, the inspector general or internal affairs, and prosecutors under state law each have a role. Agreeing in advance how a flagged lookup is referred, investigated and resolved avoids cases stalling because no office believes it owns them.
With hindsight
From 2026, Van Buren has had the effects most observers expected. In May 2022, the Justice Department revised its CFAA charging policy, directing prosecutors not to charge good-faith security research. Courts applied the gates-up-or-down test in later cases, including disputes over scraping of public websites. Insider misuse of government databases did not stop. Cases of employees misusing law enforcement, motor vehicle and benefits systems kept appearing in news reports and inspector general findings, typically handled through discipline and state law. What changed most was the expectation placed on agencies’ own controls, with query logging and pattern-based review now more common. The decision’s core message holds: if a system lets someone see a record, federal computer crime law will mostly treat that as allowed, so the system has to be designed with that in mind.