This blog has previously covered the division of authority concerning how to interpret “without authorization” and “exceed authorized access” under the Computer Fraud and Abuse Act, 18 USC § 1030. Does the CFAA merely prohibit logging in to a system one is not authorized to access, or does the CFAA impose liability on those who use their authorized access in unauthorized ways? The Findlaw site has a nice write-up on the circuit split that has evolved over the last few years on this issue. It is a good summary if you need to research this topic.